Use strict semver extraction in release workflow

Replace grep+sed with a single sed that captures exactly
major.minor.patch from src/modules.d.ts to avoid matching prerelease or
malformed versions. Exit early if extraction fails.

.github/workflows/release.yml

@@ -33,9 +33,9 @@ jobs:
       - name: Extract base version
         id: extract
         run: |
-          # Extract the base (non-prerelease) version from the build-info module.
-          # This expects a line like: const version: "1.1.4";
-          version=$(grep -m1 'const version:' src/modules.d.ts | sed -E 's/[^0-9.]//g')
+          # Extract base (non-prerelease) version like 1.1.4 from src/modules.d.ts
+          # Use a strict regex to capture exactly three numeric components (major.minor.patch)
+          version=$(sed -nE 's/.*"([0-9]+\.[0-9]+\.[0-9]+)".*/\1/p' src/modules.d.ts | head -n1)
           if [ -z "$version" ]; then
             echo "Failed to extract version" >&2
             exit 1