docs: "version bumps are mechanical; the PR round-trip adds no signal" misstates why direct-to-main is safe; workflow input validation undocumented

[carochacs]

CLAUDE.md's Versioning section justifies the sync-version workflow committing straight to main with:

version bumps are mechanical; the PR round-trip adds no signal

Two problems:

1. "Mechanical" is equated with "risk-free." A PR round-trip provides more than review signal — it runs required CI before merge. The bot commit bypasses that, so a malformed payload lands on main unreviewed. The exception is fine; the accurate justification is "low risk, validated input, CI still runs post-merge," not "no signal."
2. workflow_dispatch accepts an arbitrary version: X.Y.Z input for manual/recovery runs, and neither the doc nor (apparently) the workflow mentions validating that the input is a well-formed semver string before it is written to VERSION and committed. A typo'd manual run would ship a broken version string straight to main.

Suggested fix: add semver-shape validation to sync-version.yml (reject and fail the run on a non-matching input) and reword the CLAUDE.md rationale.

[pullfrog]

  ^{｜ Build this ➔ ｜ Make a plan ➔}