v2: generate MOLTZAP_VERSION from v2/VERSION so it can become a branded schema

[chughtapan]

Deferred from #891 / PR #893 (Phase 2 scaffolding).

Problem

docs/spec/layer-interfaces.md states v2/VERSION is the sole MoltZap
compatibility value. In the tree the CalVer is currently stated eight times:
v2/VERSION, six package manifests, and v2/identity/src/index.ts. They are
reconciled by text matching in scripts/check-architecture-boundaries.js.

That check matches only a bare string-literal initializer:

/export\s+const\s+MOLTZAP_VERSION\s*=\s*["']([^"']+)["']/

docs/architecture/first-implementation.md ("Capability contract construction")
requires branded/opaque schemas for semantic identifiers. Every form that
guidance implies is missed by the regex:

MATCH   export const MOLTZAP_VERSION = "2026.729.0";
MISS    export const MOLTZAP_VERSION: MoltzapVersion = MoltzapVersion.make("2026.729.0");
MISS    export const MOLTZAP_VERSION = Schema.decodeSync(MoltzapVersion)("2026.729.0");
MISS    const MOLTZAP_VERSION = "2026.729.0"; export { MOLTZAP_VERSION };

The check fails loud, not open — a missed form reports "must export
MOLTZAP_VERSION" rather than silently passing — so this is not a correctness
hole today. But the check is designed against a shape the plan says will not
survive, and it will need rewriting exactly when its subject is implemented.

Fix recipe

Generate v2/identity/src/version.ts from v2/VERSION and re-export it from
index.ts; generate the six manifests' version fields the same way. Gate with
git diff --exit-code, matching package.json → arch:config:check. Then delete
the regex assertion: v2/VERSION becomes genuinely sole, and the constant is
free to become a branded schema without touching the checker.

Best done together with #897, which proposes the same generator for the manifests.

[chughtapan]

Filed from PR #893 (Phase 2 scaffolding, #891).