One version, derived everywhere

SERVER_VERSION now reads package.json at runtime, so there is no second literal to drift. manifest.json still needs one, because the .mcpb format requires it — so the build regenerates it.

Same change fixes the release push: actions/checkout leaves a detached HEAD, so the bump commit had no branch to land on and only the tag reached the remote.