fix(release): read the version after checking out the base

[anoop-narang]

The bug

scripts/release.sh cmd_prepare reads the current version before it switches to the base branch:

current="$(get_version)"          # <- reads whatever branch you are on
new="$(bump_version "$bump" "$current")"
...
base="$(default_branch)"
git checkout "$base"              # <- only now on the release base
set_version "$new"

So the bump is computed from the branch the script happened to be invoked on, not from the branch being released.

How it shows up

Hit for real while releasing another repo in this family. On a stale branch at 0.10.0, prepare minor computed 0.11.0, then checked out main at 0.16.0:

Error: Cannot downgrade from 0.16.0 to 0.11.0

That failure was luck. It only errored because the version tool refuses downgrades and the branch happened to be behind. From a branch that is ahead of the base, the computed version is higher, nothing refuses it, and a release is cut under the wrong number with no error at all.

The fix

Move the version read below the checkout, so it reads the base branch. hotdata-ibis already orders it this way; this brings the rest of the family in line. Pure block move plus a comment — no behaviour change when the script is run from an already-current base branch, which is the documented path.

Scope

The same defect is in seven repos sharing this script. Companion PRs are open in each.

[claude]

Prior super nit is resolved: the bump kind is now validated at scripts/release.sh:106, before the checkout at scripts/release.sh:115. The version read now happens on the base branch, which fixes the wrong-base bump. No new findings.

[anoop-narang]

Two follow-ups from review applied across all seven repos in this family, so they stay identical:

1. VERSION_RE / BUMP_KIND_RE hoisted to one definition each, since the explicit-version pattern was otherwise written twice and could drift.
2. The comment above the argument check narrowed — an unchanged version and a pre-release suffix are detected from the base branch's version, so those necessarily fail after the checkout and the comment should not imply they don't.

Accept/reject behaviour is unchanged: patch/minor/major/1.2.3 accepted; pathc, empty, 1.2, v1.2.3, 1.2.3-rc1 rejected.

[claude]

Prior feedback is addressed. The bump kind check now runs before the checkout, and the shared version pattern is used unquoted on the right side of =~, which keeps regex matching intact.