Release integrity: 1.8.1 on PyPI reports __version__ 1.8.0, and the v1.8.2 tag points at a commit on no branch

[VickyXAI]

Two release problems from the 1.8.1 cut, one already irreversible.

1. The published 1.8.1 wheel reports the wrong version

a762ab3 ("release: 1.8.1") bumped only pyproject.toml, leaving VERSION and blockrun_llm/__init__.py at 1.8.0. It was tagged and published in that state.

$ curl -s https://pypi.org/pypi/blockrun-llm/json | jq -r .info.version
1.8.1

So pip install blockrun-llm==1.8.1 gives a package that reports __version__ == "1.8.0". PyPI does not permit overwriting a published file, so the artifact cannot be corrected — only superseded.

tests/unit/test_version_consistency.py exists precisely to catch this and did catch it, but on CI after the release was already cut. #29 repaired main; it could not repair the wheel.

This is the second occurrence. The same failure shipped in 1.4.6 (bumped pyproject.toml, missed __init__.py), which is why the guard test was added.

2. v1.8.2 is tagged on origin but points at a commit that is on no branch

$ git ls-remote --tags origin | grep 1.8.2
fda7ff2...  refs/tags/v1.8.2
d020317...  refs/tags/v1.8.2^{}

$ git branch -r --contains d020317
(empty)

d020317 ("release: 1.8.2 — correct the version the package reports about itself") is not an ancestor of origin/main. origin/main is still 82312bb, where all three declarations read 1.8.1.

Left as-is: main never receives the 1.8.2 release commit, main and the tag disagree about what 1.8.2 is, and the next release collides with a version that is already tagged.

Suggested resolution

• Get d020317 onto main (cherry-pick or PR) so the tag and the branch agree, then publish 1.8.2 so users have an artifact whose __version__ is truthful.
• Make the publish path unable to repeat this: run pytest tests/unit/test_version_consistency.py between the bump and the tag, not only in CI afterward. A release script that bumps all three declarations from a single source, or a pre-tag hook, would close it for good.

Found during /review of #27.