ci: guard the Leiningen install coordinate

The release gate checked only the deps.edn coordinate form, in README.md
and doc/*.md. The Leiningen form was unverified anywhere, so it could
drift silently: buddy-auth shipped 5.0.0 with a guide telling Leiningen
users to install 4.0.2, a release predating its OIDC audience and expiry
fixes.

The check is scoped to the artifact being released, so a companion
coordinate in the same file (psql-clj's modules, beckon and beckon-ffm
referencing each other) is left alone.

Author: jsavyasachi

.github/workflows/release.yml

@@ -69,6 +69,24 @@ jobs:
             done < <(grep -oE "net\.clojars\.[a-zA-Z0-9._/-]+ \{:mvn/version \"[^\"]+\"\}" "$f" | grep -F "$LIB {:mvn/version" | grep -oE '"[^"]+"' | tr -d '"')
           done
           exit $rc
+
+      - name: Verify Leiningen install coordinates match version
+        if: github.ref_type == 'tag'
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          LIB=$(grep -oE "net\.clojars\.[^ ')]+" build.clj | head -1)
+          rc=0
+          shopt -s nullglob
+          for f in README.md doc/*.md; do
+            [ -f "$f" ] || continue
+            while IFS= read -r ver; do
+              if [ "$ver" != "$TAG" ]; then
+                echo "::error file=$f::$f pins [$LIB \"$ver\"], expected \"$TAG\""
+                rc=1
+              fi
+            done < <(grep -oE "\[net\.clojars\.[a-zA-Z0-9._/-]+ \"[^\"]+\"\]" "$f" | grep -F "[$LIB \"" | grep -oE '"[^"]+"' | tr -d '"')
+          done
+          exit $rc
       - name: Verify tag commit is on main
         if: github.ref_type == 'tag'
         run: |