emrg: publish v0.3.31 so the round-shape prompt reaches installed clients #2619

master carries a change to the prompt every session receives, and no installed client has it: v0.3.30 was published from 290c4620, and two commits have landed since.

Baseline. Current Latest release = v0.3.30 (published 2026-10-28T05:36:30Z, 11 assets — four platforms, a macOS .pkg, and two .zsync). master = 39a9ed20. The commits since that release:

• 39a9ed20 (emrg: a round has two shapes and no third #2616) — the session prompt's "plan before acting" line becomes a hard shape rule: a round has exactly two shapes, "no tool calls" or "five or more tool calls", and a round below five must say what sending fewer bought. Four guard tests were rewritten with it.
• 1dc13291 (emrg: pin the app icon's design source with a guard #2612) — a mechanical guard pinning the app icon's design source. New tests, no runtime change.

The only difference a user can see is the first one: the prompt a session receives changes. Until this is published it exists only in the repository, and every installed host — this machine included — still runs the old prompt.

What finishing this needs.

1. Every version declaration moves through the one producer: python3 scripts/bump-version.py 0.3.31 rewrites eight declarations in eight files at once, never by hand. tests/test_version_sync.py holds them in agreement.
2. An annotated tag v0.3.31, pushed. The tag is the only trigger of build-release.yml; the Test workflow neither signs nor notarizes, so a green Test says nothing about the published artifacts.
3. The macOS leg must show real output, not merely a green job: Build GUI (electron-builder) and Make installer succeed, and the app.asar inside the .pkg belongs to this build.

Acceptance.

• Before the tag: python3 scripts/bump-version.py --check reports all eight sources agree on 0.3.31, and python3 scripts/check-release-tag.py v0.3.31 passes.
• The bump PR's Test run is green on both legs: test (ubuntu-latest) and test-windows (windows-2025).
• The tag run's Build Release is green on all four matrix legs: macos-15 arm64, ubuntu-24.04 x86_64, ubuntu-24.04-arm aarch64, windows-2025 x64.
• python3 scripts/check-release-published.py v0.3.31 reports published, not draft, not prerelease, 11 assets, with GitHub's Latest = v0.3.31, and every asset named.
• The prompt is read out of a published artifact, not out of the repository: download EMRG-0.3.31-macos-arm64.pkg (or any asset that carries the runtime), unpack it, and read the system.j2 inside. It must contain ## Plan before every call and must no longer contain **Plan the round before the first call.**. Asserting the file in this tree does not satisfy this: build-release.yml's own "Assert the artifacts carry this tree's agent prompt" reads the same tree this does.
• If the tag run fails, the same work closes it out — gh run rerun <id> --failed (the tag need not be re-pushed), or a record stating plainly that this version was not published. A bare tag that silently blocks the upgrade chain is not an acceptable end state.