[neo-th]

Bumps the version to 0.9.4 and adds a release tag check. Pushing the tag after this merges publishes the striper fix, which is on main but unreleased.

Changes

• Version: 0.9.4 in control-plane/Cargo.toml, Cargo.lock (this package's entry only), client-py/pyproject.toml, client-py/hypercache/__init__.py and the default tag in release.yml.
• Changelog: Unreleased becomes 0.9.4, and the CI script fix and the tag check are added.
• Tag check: a new check-release-tag job in release.yml runs first and compares the tag with the three version files. Every other job depends on it, so a mismatch stops the release before anything is built or published. Tags can't be moved or deleted, so the number is still used up.

Testing

• Tag check: I ran the job's script locally. v0.9.4 passed, and v0.9.3, v0.9.4-rc1, 0.9.4 and main failed as intended. The job itself first runs on GitHub when the tag is pushed.
• Full harness on macOS: took two runs, and everything passed except the checks below. The first run's image build failed on a local Docker permission error, so I reran the image and k8s stages with a temporary BUILDX_CONFIG, and both passed.
• Skipped locally: the YAML syntax check (PyYAML not installed) and the bare-metal e2e (needs Linux). CI on this PR runs both.

After merging

Once CI passes on the commit in main, tag it: git tag v0.9.4 <commit> && git push origin v0.9.4. Merge #7 too, since it documents these rules.