feat(release): enforce aligned trusted publications

tools/release/govoplan_release/git_state.py

@@ -99,6 +99,7 @@ def collect_versions(path: Path) -> VersionSnapshot:
         package=read_json_version(path / "package.json"),
         webui_package=read_json_version(path / "webui" / "package.json"),
         manifests=read_manifest_versions(path),
+        package_inits=read_package_init_versions(path),
     )
 
 
@@ -137,6 +138,21 @@ def read_manifest_versions(path: Path) -> tuple[str, ...]:
     return tuple(versions)
 
 
+def read_package_init_versions(path: Path) -> tuple[str, ...]:
+    """Read public runtime versions declared by top-level Python packages."""
+
+    src = path / "src"
+    if not src.exists():
+        return ()
+    versions: list[str] = []
+    for package_init in sorted(src.glob("*/__init__.py")):
+        text = package_init.read_text(encoding="utf-8")
+        match = re.search(r'(?m)^__version__\s*=\s*["\']([^"\']+)["\']', text)
+        if match is not None:
+            versions.append(match.group(1))
+    return tuple(versions)
+
+
 def git_text(path: Path, *args: str, timeout: int = 10) -> str:
     result = git(path, *args, timeout=timeout)
     return result.stdout.strip() if result.returncode == 0 else ""