chore(version): single source of truth — release tag → FIRMWARE_VERSION macro

Audit revealed the Status screen hardcoded "v0.6.0" while v0.6.1 and
v0.6.2 had already shipped — the version string was scattered and
fell behind every release. Centralizing:

- CMakeLists.txt: target_compile_definitions adds
  FIRMWARE_VERSION="${VERSION}" so the existing -DVERSION=$tag flag
  passed by release.yml propagates into C++ as a compile-time macro.
  Local builds without -DVERSION get "dev" — a deliberate "this is
  not a release build" tell on the Status header.
- src/oled.cpp render_screen() now renders
  "DS5 Bridge " FIRMWARE_VERSION via string-literal concatenation. The
  only place a version literal exists in source is now the macro at
  the link layer.
- CLAUDE.md gets a "Versioning — single source of truth" section
  documenting the release ritual (CHANGELOG bump → tag → push → gh
  release create → CI builds + propagates) and naming the
  WEB_REPO_DISPATCH_PAT follow-up that's still pending.

Web preview is updated separately to read firmware-latest.json at
runtime — same single source of truth, different distribution path
(the GitHub API).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CMakeLists.txt

@@ -146,6 +146,14 @@ if(WAKE_DEBUG)
 endif()
 set(VERSION "dev" CACHE STRING "Program version string")
 
+# Expose VERSION to firmware C++ as FIRMWARE_VERSION so src/oled.cpp's
+# Status header always reflects the release tag (set by release.yml via
+# -DVERSION="$FIRMWARE_VERSION"). Local builds without -DVERSION show
+# "dev" — visible signal that you're not on a tagged release.
+target_compile_definitions(ds5-bridge PRIVATE
+        FIRMWARE_VERSION="${VERSION}"
+)
+
 set_target_properties(ds5-bridge PROPERTIES OUTPUT_NAME "ds5-bridge-oled")
 pico_set_program_name(ds5-bridge "ds5-bridge-oled")
 pico_set_program_version(ds5-bridge "${VERSION}")