CI guard: action.yml's pinned version should match the latest release

[jbeda]

Problem

action.yml pins a specific modelith release as its version input default
(see CLAUDE.md's "Cutting a release" checklist). That bump is a manual step
after every release — easy to forget, and nothing currently catches it if it
is. A forgotten bump doesn't error; it just silently leaves the action
installing an old release indefinitely.

Proposed fix

Add a CI check (or a step in release.yml itself) that fails if
action.yml's version default doesn't match the most recent release tag.
Options to weigh:

• A check in ci.yml that runs on every PR touching action.yml or on a
  schedule, comparing the pinned default against gh release view --json tagName (or the GitHub API equivalent).
• A step at the end of release.yml that bumps action.yml automatically and
  opens a PR (or commits directly, mirroring how the Homebrew formula is
  pushed automatically today).

The second option removes the manual step entirely rather than just catching
it after the fact — probably the better end state, but more work and a
different failure mode (auto-commit vs. CI gate) to think through.

Context / priority

Not urgent — there's currently exactly one release (v0.4.0) and the default
is correct. Worth doing before this becomes a recurring manual step that
eventually gets missed.