fix(version): resolve app version from package.json, not git describe

Cloudflare Workers Builds deploys master continuously without setting
ZPAN_APP_VERSION, and its checkout has no tags, so git describe --always fell
back to a bare commit hash — the deployed Worker showed a commit instead of a
version. package.json is present in every build environment, so read the
version from it when ZPAN_APP_VERSION is unset. Release/Docker/GH-action
deploys still pass the exact tag via the env var, which keeps priority.

Release process: bump package.json on each release so Workers Builds reports
the right version.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/app-version.mjs

@@ -1,13 +1,13 @@
-import { execSync } from 'node:child_process'
+import { readFileSync } from 'node:fs'
 
 export function resolveAppVersion() {
-  // The Docker build excludes .git from its context, so git describe cannot run
-  // there. The release pipeline passes the tag in via ZPAN_APP_VERSION instead.
+  // Release/Docker builds pass the exact tag via ZPAN_APP_VERSION. Everything
+  // else (Cloudflare Workers Builds, local dev) reads package.json — a source
+  // that is present in every build environment, unlike git tags, which are
+  // absent from the Workers Builds checkout and from the Docker context.
   if (process.env.ZPAN_APP_VERSION) {
     return process.env.ZPAN_APP_VERSION
   }
-  return execSync('git describe --tags --always --dirty', {
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'pipe'],
-  }).trim()
+  const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'))
+  return pkg.version
 }