[codex] validate package manifest version

[favoyang]

Summary

• Add validatePackageManifest.js for exact package name and version validation after package discovery.
• Run the helper in the git-source pipeline before npm pack so mismatched package.json.version fails early.
• Use clearer version mismatch log text that reports package.json.version and expectedReleaseVersion.
• Align GitHub Release asset version mismatch wording with the same rule.

Impact

Git checkout builds now keep the existing guardrail: the package manifest must match the queued package name and parsed release version. The mismatch text is stable for downstream classification and author-facing diagnostics.

Validation

• npm test
• npm run lint
• npm run format:check
• npm run typecheck
• node validatePackageManifest.js test/fixtures/release-asset-package com.example.release-asset 1.0.0

[favoyang]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".