feat(release): enforce aligned trusted publications

tests/test_release_doctor.py

@@ -51,6 +51,22 @@ class ReleaseDoctorTests(unittest.TestCase):
         self.assertEqual("repo-dirty", findings[0].check_id)
         self.assertIn("git status --short", [item.command for item in findings[0].commands])
 
+    def test_repo_version_mismatch_blocks_release(self) -> None:
+        doctor = load_doctor_module()
+        repo = doctor.RepoState(
+            name="govoplan-files",
+            path="/tmp/govoplan-files",
+            exists=True,
+            pyproject_version="0.1.9",
+            package_version="0.1.8",
+            webui_package_version="0.1.9",
+        )
+
+        findings = doctor.repo_findings((repo,), target_version="0.1.9", target_tag="v0.1.9")
+
+        mismatch = next(item for item in findings if item.check_id == "repo-version-mismatch")
+        self.assertEqual("blocker", mismatch.severity)
+
     def test_dubious_ownership_errors_suggest_safe_directory_command(self) -> None:
         doctor = load_doctor_module()
         repo = doctor.RepoState(