Bump to 1.0.7 and guard publish against tag/version drift

[ls-simon-he]

Summary

• Bump package.json / package-lock.json to 1.0.7 to recover from the broken v1.0.6 release (tag was cut without bumping the version, so CI silently republished 1.0.5 to GitHub Packages and exited 0).
• Add a pre-publish step in .github/workflows/npmpublish.yml that asserts package.json.version matches the release tag (stripped of the v prefix) and fails the job otherwise.

Context

• v1.0.6 tag points to 88a0841, but package.json at that commit is still 1.0.5.
• Registry currently has: 1.0.1, 1.0.4, 1.0.5 — no 1.0.6 will ever exist.
• The existing v1.0.6 tag and GitHub release are left in place as artifacts; a fresh v1.0.7 tag/release after this merges will publish correctly.

Release steps after merge

1. Pull master.
2. Tag: git tag -a v1.0.7 -m "v1.0.7" && git push origin v1.0.7
3. Create a GitHub release for v1.0.7 — the workflow will publish @kounta/db.js@1.0.7.

If anyone forgets to bump package.json next time, the new guard will fail the publish job with a clear error instead of silently no-op'ing.

Test plan

• CI build job passes on this PR.
• After merge + tag + release, the publish job runs the new guard step and succeeds.
• @kounta/db.js@1.0.7 appears in GitHub Packages.
• (Negative test, optional) Confirm the guard fails loudly if a future release tag mismatches package.json.

🤖 Generated with Claude Code