build: refuse a bump that would strand schema work in a released migration

[amitdugar]

After a release the open migration file is named for a version that has already
been published, and writing DDL into it is the obvious thing to do -- it is the
only open file. But a lab already on that version never replays it, so the
change reaches nobody, and the next bump closes the file and leaves an empty
stub beside it: two migration files for one change, one of them silently inert.

The bump now compares the open file against the release tag and stops if it has
grown since, naming the file to move the statements into and the command to
restore the released one.

It refuses rather than moving them itself. Which statements have already shipped
is the author's knowledge, not the script's, and both wrong answers are bad:
DDL that reaches no lab, or DDL applied twice. Anything git cannot answer reads
as "not released", so the ordinary bump behaves exactly as before.