CI: prevent publishing a plugin version without its matching git tag

## Problem

A published plugin version can ship without its matching git tag, which breaks the `SessionStart` hook for every user on first startup.

Concretely: plugin `asta-preview` (and `asta`) was bumped to `0.18.0` in `pyproject.toml` + the marketplace manifest, but the `v0.18.0` git tag was never pushed (latest was `v0.17.2`). The `SessionStart` hook runs `hooks/sync-cli-version.sh`, which does:

```
uv tool install --force "git+https://github.com/allenai/asta-plugins.git@v0.18.0"
```

With no `v0.18.0` tag on the remote this fails:

```
Updating https://github.com/allenai/asta-plugins.git (v0.18.0)
error: Git operation failed
Caused by: failed to fetch branch or tag `v0.18.0`
fatal: couldn't find remote ref refs/tags/v0.18.0
```

Claude Code surfaces this as a non-blocking `SessionStart:startup hook` error on every session start until the tag exists.

## Contributing factors

- The `0.18.0` version bump rode in on feature PR #69 (`40890a1`) rather than a dedicated release commit, so it was easy to merge the version bump without cutting/pushing the tag.
- The `v0.17.2` release line (`1bdb498`) is **not an ancestor of `main`** — the release history had diverged, making it easy to lose track of which version `main` actually represents.

## Suggested fix

Add a CI check (PR + tag-push) that asserts a `vX.Y.Z` tag exists matching the `version` in `pyproject.toml` / the marketplace manifest before a version bump is considered released. Options:

- On PRs that change the manifest/`pyproject.toml` version, fail if the bumped version has no corresponding `vX.Y.Z` tag (or require the release to be cut atomically).
- Or automate tag creation on merge when the version field changes, so manifest version and git tag can never drift.

## Workaround / immediate remediation

The missing `v0.18.0` tag has already been pushed (pointing at `40890a1`, the only commit where `pyproject.toml` declares `0.18.0`), which resolves the live error. This issue tracks preventing recurrence.