Release version management: single VERSION file as source of truth

- VERSION at repo root (0.1.2); bump it to cut a release
- App: generated AppVersion.kt (config-cache-safe Gradle task with
  VERSION as declared input) shown in Settings; sent to the gateway
  via X-Iris-App-Version header on the SSE open
- Gateway: reports its own version in hello.ack server_caps.app_version
  (read from the repo-root VERSION via the plugin symlink); stores the
  app's version in the device registry caps (merge, not overwrite, so
  an old app reconnecting without the header doesn't wipe it)
- Settings: app + gateway version rows, mismatch hint, and a best-effort
  Gitea latest-release check (ReleaseCheck) with an 'update available' hint
- Release workflow: reads VERSION from the repo (no manual input), with
  a guard against an empty file
- Docs: frames.schema.json + 04-wire-protocol.md updated for app_version

gateway-plugin/version.py

@@ -0,0 +1,26 @@
+"""Version discovery -- the repo-root ``VERSION`` file is the single source
+of truth for the release version ("everything from here on out is vX.Y.Z"
+= bump ``VERSION`` and commit).
+
+The plugin lives at ``<repo>/gateway-plugin`` (installed into
+``~/.hermes/plugins/iris`` as a symlink in production), so the ``VERSION``
+file is one directory up. The value is advertised to the app in
+``hello.ack`` (``server_caps.app_version``) so the app can show which
+gateway version it is talking to.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+_FALLBACK = "unknown"
+
+
+def plugin_version() -> str:
+    """The release version from ``<repo>/VERSION``, or ``"unknown"``."""
+    candidate = Path(__file__).resolve().parent.parent / "VERSION"
+    try:
+        version = candidate.read_text().strip()
+    except OSError:
+        return _FALLBACK
+    return version or _FALLBACK