fix: correct version-check hook to use global latest tag

The pre-commit version check hook was incorrectly using `git describe`
to find the latest tag, which only traverses the current branch's
ancestry. On feature branches that predate release tags applied to
main/nightly, this caused false failures — reporting v0.19.1 as latest
even though v0.20.0 and v0.21.0 existed globally.

Replaced with `git tag --sort=-v:refname | grep semver | head -1` so
the check always compares .version against the true latest release tag
in the repository, independent of which branch is checked out.

.version

@@ -1 +1 @@
-v0.19.1
+v0.21.0

scripts/check-version-match-tag.sh

@@ -19,7 +19,11 @@ if [ ! -f ".version" ]; then
 fi
 
 VERSION_FILE=$(cat .version | tr -d '\n' | tr -d '\r')
-GIT_TAG="$(git describe --tags --abbrev=0 2>/dev/null || echo "")"
+# Use the globally latest semver tag, not just tags reachable from HEAD.
+# git describe --tags --abbrev=0 only finds tags in the current branch's
+# ancestry, which breaks on feature branches where release tags were applied
+# to main/nightly and haven't been merged back yet.
+GIT_TAG="$(git tag --sort=-v:refname 2>/dev/null | grep -E '^v?[0-9]+\.[0-9]+' | head -1 || echo "")"
 
 if [ -z "$GIT_TAG" ]; then
   echo "No tags in repository; cannot validate .version against tag"