Fail the build when the project version and the release notes disagree

A version bump is manual and easy to forget on a deployment — it happened
twice on 2026-09-03, leaving a running instance whose footer/--version
claimed a version stale by two deployments. ReleaseVersionConsistencyTest
now compares build.gradle.kts against the top entry of releases.html so a
forgotten bump, or notes written for a version nothing was built as, fails
before an artifact can even be produced.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/test/kotlin/de/hoennig/werkator/ReleaseVersionConsistencyTest.kt

@@ -0,0 +1,29 @@
+package de.hoennig.werkator
+
+import io.kotest.core.spec.style.FunSpec
+import io.kotest.matchers.shouldBe
+import io.kotest.matchers.shouldNotBe
+import java.io.File
+
+/**
+ * A version bump is easy to forget on a deployment (it happened twice on 2026-09-03) — this
+ * fails the build so a deployment can never carry an artifact whose footer/`--version` claims
+ * a release that has no notes, or notes for a release nothing was actually built for.
+ */
+class ReleaseVersionConsistencyTest : FunSpec() {
+    init {
+        test("the top release-notes entry names the current project version") {
+            val buildGradle = File("build.gradle.kts").readText()
+            val versionMatch = Regex("""^version = "([^"]+)"""", RegexOption.MULTILINE).find(buildGradle)
+            versionMatch shouldNotBe null
+            val projectVersion = versionMatch!!.groupValues[1]
+
+            val releaseNotes = File("src/main/resources/templates/releases.html").readText()
+            val topHeadingMatch = Regex("""<h2>v([0-9.]+)\s""").find(releaseNotes)
+            topHeadingMatch shouldNotBe null
+            val topReleasedVersion = topHeadingMatch!!.groupValues[1]
+
+            topReleasedVersion shouldBe projectVersion
+        }
+    }
+}