Reconcile package.json version with latest git tag

[PAMulligan]

Problem

package.json reports 0.5.0 while the latest git tag is v1.0.0. Consumers checking either source see different answers about which version they are on.

Acceptance criteria

• Decide on the canonical source of truth (tag vs package.json)
• Bump package.json to match the intended next release (likely v1.1.0)
• Document the version bump policy in CONTRIBUTING.md
• Add a CI check that fails when package.json and the latest tag drift

Milestone

v1.2.0