Unstamped builds report a real version (0.34.5), making log versions untrustworthy

[jschatz1]

cmd/kai/main.go:92 declares:

var Version = "0.34.5"

This is the fallback for builds where the release ldflags stamp isn't applied. It is a hardcoded real version number, so an unstamped binary — built from any commit, however new or old — confidently reports 0.34.5 and prints Update available: 0.34.5 → 0.35.39.

That makes the version in any log untrustworthy: 0.34.5 means either "genuinely v0.34.5" or "unstamped build of unknown provenance", with no way to tell them apart.

How this bit

Diagnosing marketing-site run #122 (see #58), the job log showed 0.34.5. The obvious read — CI is running an old binary missing the 2026-08-26 conclusion-deadline fix (f20db8a, released in v0.35.34) — is unfalsifiable, because an unstamped build of current main prints exactly the same string. The diagnosis is stuck on it.

Note that v0.34.5 is itself the release tagged "ci: stamp CLI version from the git tag (fix stale kai version)" — the stamping was fixed then, but the fallback constant was left frozen at that number and has drifted ~35 releases out of date since.

Fix

• Unstamped builds report something unmistakably non-release — dev, or dev (unstamped), ideally with the build's commit SHA via runtime/debug.ReadBuildInfo
• The update check never offers an upgrade path from an unstamped build (0.34.5 → 0.35.39 is meaningless noise, printed three times in one job log)
• Confirm the release pipeline actually applies the stamp on every published artifact
• Confirm what the CI job environment runs and how it is provisioned — an unstamped binary in CI is its own problem