Release scripts: bulletproof test-deploy data preservation + tag/version gate

Local checkpoint - NOT for public release.

Two gaps found reviewing the publish/release scripts:

- deploy-test.ps1: the binary sync (publish -> D:\Dropbox\remsound) used /E with no /MIR,
  so it never DELETES user data - but it could OVERWRITE it if publish\ ever accumulated a
  "user settings and logs" folder. Added /XD/'user settings and logs','recordings','logs',
  'profiles','config' + /XF 'global config.json','remsound.config.json' so the binary sync
  is physically incapable of touching Ed's profiles/logs/config in either direction. Test
  deploys keep ALL of his data current, by construction.

- build-release.ps1: never checked the -Tag against the csproj <Version>. A mismatch ships
  RemSound-<tag>.zip containing a different version's binary, which the in-app updater (it
  downloads by tag name) reads as a perpetual "update available". Now aborts up front if
  tag != csproj <Version> - also catches a forgotten version bump.

The intended split was already correct: test deploy keeps everything; build-release
publishes to a fresh folder, strips pdb, and scans staged files AND the zip for any
profiles/logs/config/recordings, aborting if found.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy-test.ps1

@@ -43,7 +43,13 @@ foreach ($loc in $runLocations) {
     # Binaries: publish\ already has them from the publish above; copy them to the other location(s).
     if (-not $soundOnly -and $loc -ne $publish) {
         Write-Host "Deploying program + binaries -> $loc (preserving user settings/logs) ..." -ForegroundColor Cyan
-        Invoke-Robocopy @($publish, $loc, '/E')   # no /MIR: never delete the user's settings/logs/profiles
+        # /E copies the program + binaries; NO /MIR so we never DELETE the user's data. The /XD
+        # excludes make the copy incapable of OVERWRITING it either: if publish\ ever accumulated a
+        # user-data folder (a stray run from there), it must never land on Ed's real Dropbox profiles/
+        # config/logs. The binary sync only ever carries program files, never user state, both ways.
+        Invoke-Robocopy @($publish, $loc, '/E',
+            '/XD', 'user settings and logs', 'recordings', 'logs', 'profiles', 'config',
+            '/XF', 'global config.json', 'remsound.config.json')
     }
     # THE point of this script: the whole source 'default sounds' folder, force-copied over THIS
     # location's copy, every time. /IS = copy even files robocopy thinks are identical; /IT = copy