feat(release): RELEASE identity + image tag single-sourcing (#10)

- RELEASE file: single source of release version (0.0.X until declared stable)
- common.sh load_release(): validates version, derives
  MOSAIC_IMAGE_TAG=mosaic-poc-agent:<pi>-r<release> from the pinned pi dep
- compose.yaml: image tag is required env; build/hello/verify call load_release
- verify.sh derives the image name instead of hardcoding it
- package.json version aligned to the same 0.0.X line

Closes #10

package.json

@@ -1,6 +1,6 @@
 {
   "name": "mosaic-stack-dev-test",
-  "version": "0.1.0",
+  "version": "0.0.3",
   "private": true,
   "description": "Minimal Mosaic Stack container proof of concept: one Pi agent, four local contract files, one real model request returning MOSAIC_HELLO_OK.",
   "license": "UNLICENSED",