feat(release): RELEASE identity + image tag single-sourcing (#10)

- RELEASE file: single source of release version (0.0.X until declared stable)
- common.sh load_release(): validates version, derives
  MOSAIC_IMAGE_TAG=mosaic-poc-agent:<pi>-r<release> from the pinned pi dep
- compose.yaml: image tag is required env; build/hello/verify call load_release
- verify.sh derives the image name instead of hardcoding it
- package.json version aligned to the same 0.0.X line

Closes #10

scripts/verify.sh

@@ -14,10 +14,11 @@ cd "$(dirname "$0")/.."
 # shellcheck source=common.sh
 source scripts/common.sh
 
-IMAGE="mosaic-poc-agent:0.84.4"
 EXPECTED="${EXPECTED_MARKER:-MOSAIC_HELLO_OK}"
 
 load_config
+load_release
+IMAGE="$MOSAIC_IMAGE_TAG"
 
 # Ensure the configured data root exists (host-owned) before the mount,
 # otherwise Docker would auto-create a root-owned directory.