Add single-source CLI version management and release workflow

[bencehezso]

Summary

CLI_VERSION was hardcoded to "v1.0.0" in config.py — a user-editable file — while git tags had moved on to v1.1.4, and pyproject.toml carried a second version that drifted independently. That version is sent in the assessment payload to exitcloud.io/escapecloud.io and used to debug by CLI version, so it needs one reliable source. This PR establishes a single source of truth for the version, wires it into the payload and a --version flag, and adds a guarded manual release workflow so tagging can't drift from the version file again.

What changed

• utils/version.py (new) — __version__ is the single source of truth. Starts at 1.0.0; the release workflow is the only thing that bumps it.
• pyproject.toml — version is now dynamic, derived from utils.version.__version__. Eliminates the second, independently-drifting version.
• config.py — removed CLI_VERSION and its "do not modify" note; the file is now purely user config (HOST/KEY).
• core/utils_sync.py — assessment payload reports f"v{__version__}".
• main.py — added --version (cloudexit vX.Y.Z) and moved argument parsing ahead of the ASCII art and initialize_dataset(), so --version/--help exit before any side effects (no dataset download just to print a version).
• tests/test_utils_sync.py — dropped the now-unused CLI_VERSION fake.
• .github/workflows/release.yml (new) — manual workflow_dispatch: validates the version, refuses to re-release an existing tag (checked against the remote via git ls-remote, so it works with the shallow checkout), refuses to run off main, then bumps utils/version.py, commits, tags vX.Y.Z, and pushes. Only users with write access can trigger it.