feat: add CI check to enforce version bump on every PR

.github/workflows/version-check.yml

@@ -0,0 +1,25 @@
+name: version-check
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  version-bump:
+    name: Version Bump Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check VERSION was bumped
+        run: |
+          if git diff origin/main...HEAD --quiet -- VERSION; then
+            echo "::error::VERSION file was not changed. Please bump the version before merging."
+            echo ""
+            echo "Update the VERSION file with the new version number."
+            echo "See https://semver.org for versioning guidance."
+            exit 1
+          fi
+          echo "VERSION was bumped. ✓"

TODOS.md

@@ -0,0 +1,9 @@
+# TODOs
+
+## Mark `version-check` as required in GitHub branch protection
+
+**Why:** The CI check runs on every PR but doesn't block merging until it's marked as a required status check. Without this, developers can still merge PRs that skip the version bump.
+
+**How:** After the version-check workflow PR is merged, go to GitHub → Settings → Branches → Branch protection rules → main → Require status checks to pass → add `Version Bump Check`.
+
+**Added:** 2026-03-27

VERSION

@@ -1 +1 @@
-1.0.1
+1.0.2