Single source of truth for version bumps across Cargo, Node, Python, README

[XuebinMa]

Summary

Split from #4. The version string 0.2.0-rc1 currently lives in at least:

• Cargo.toml (workspace)
• pyproject.toml (root)
• crates/agent-guard-python/pyproject.toml
• crates/agent-guard-node/package.json (likely; not verified)
• README.md (badge, prerelease link, latest-release link)
• CLAUDE.md

./scripts/verify.sh already detects inconsistencies, but the bump itself is still manual.

Scope

• pick one source of truth (likely workspace Cargo.toml) and derive others from it
• script the bump in ./scripts/release/bump-version.sh or similar, runnable in CI on release prep
• ensure verify.sh continues to catch drift

Out of Scope

• full release automation (changelog generation, tag pushing, registry publishing) — separate work