release: published agent.json version is stale and outside the version-sync gate

[dirvine]

P3 — published release metadata drift, confirmed during the patch-release audit.

The actual agent.json downloaded from release v0.41.3 reports version 0.10.0. The same stale value exists in .well-known/agent.json:4. .github/workflows/release.yml:496 copies this file into every release, but scripts/bump-version.sh:27-43 and validate_version_sync in .github/scripts/validate_release_metadata.py:347 synchronize only Cargo.toml and SKILL.md. Therefore a green release metadata gate does not ensure the public agent card identifies the shipped release.

Fix: generate the release card version from the canonical package version or include it in the version-bump and validator contract. Add a negative mismatch fixture and inspect the generated/downloaded asset against the tag. Preserve unrelated protocol/schema versions; do not blindly replace every semver in the card.

This finding concerns the published static asset, not proof that runtime A2A endpoints return the same card. No runtime or cryptographic capability failure is claimed.

[dirvine]

Source repair is merged in #520 (996636b) and remains present on main694f03d. The static agent card now matches the staged package version0.41.4; bump-version updates that card, and validate_version_sync reads its configured input and rejects mismatches, including a staged asset supplied through --agent-card.

I ran the exact current-main offline release metadata regressions in a disposable directory: 7/7 passed, exit0. This covers staged-card/tag matching, stale source/staged cards, version-bump atomicity and invalid-input failure behavior. No release was created or downloaded. Keeping this issue open for its remaining explicit acceptance: inspect the next published/downloaded agent.json against the actual tag after David GO. The old v0.41.3 asset has not been repaired by a source commit.