fix(plugins): publish each ABI as a new plugin version, verify built kit matches label (#1380)

[datlechin]

Problem (#1380, also the residual of #1322)

After the PluginKit ABI bump to 15 shipped in v0.44.0, users still could not install or update registry plugins (Cloudflare D1, and in fact all 10). The app correctly reported "Plugin was built for PluginKit version 14; this release needs version 15".

Root cause: the bulk re-release reused existing tags

release-all-plugins.sh paired each plugin's latest existing tag (e.g. plugin-cloudflare-d1-v1.0.22) with the new PluginKit version, and the build workflow does gh release delete + gh release create on that same tag. Reusing one tag/asset URL for two different ABIs has two failure modes:

1. The download URL never changes, so the GitHub release CDN serves the previously cached (kit 14) asset for an unpredictable window after the asset is replaced. Users who updated in that window downloaded a kit 14 binary even though the release now held kit 15.
2. The previous ABI's binary at that URL gets overwritten, so consumers on the older app version (kit 14) start downloading the kit 15 binary and break too.

--keep-kit-versions 2 only works if each ABI is a distinct artifact at a distinct URL. Reusing the tag collapsed both ABIs onto one URL.

Fix

• release-all-plugins.sh now bumps the patch version (e.g. v1.0.22 to v1.0.23) and dispatches the new tag, so each ABI publishes fresh binaries at a new release URL. No overwrite, no CDN staleness, and the two retained ABIs stay distinct. Also fetches tags first so the latest version is read correctly.
• build-plugin.yml gains a guard: after building, it reads the bundle's TableProPluginKitVersion and fails the job if it does not match the pluginKitVersion the release is labeled with. A mislabeled binary can no longer reach the registry.

Follow-up to unblock users

Run ./scripts/release-all-plugins.sh 15 (with this fix) to publish all 10 registry plugins at new versions with genuine kit 15 binaries.

No app code changes; the app already shows the correct, actionable message.