DC-002: Sync root VERSION with package.json + keep them in sync via release.sh

- Updated root VERSION file from 1.13.0 → 1.13.4 to match package.json.
- scripts/release.sh now writes both files on every release bump, and
  stages VERSION alongside package.json in the release commit.
- This prevents the drift that caused the stale VERSION in the first place.

scripts/release.sh

@@ -43,14 +43,17 @@ echo "  release: $RELEASE_HOST"
 echo "  mirror:  $MIRROR_HOST"
 echo
 
-# ── 1. Bump dashcaddy-api/package.json ────────────────────────────────────
-echo "[1/6] Bumping dashcaddy-api/package.json"
+# ── 1. Bump dashcaddy-api/package.json + root VERSION file ──────────────
+echo "[1/6] Bumping dashcaddy-api/package.json + VERSION"
 node -e "
   const fs = require('fs');
   const pkg = require('./dashcaddy-api/package.json');
   pkg.version = '$VERSION';
   fs.writeFileSync('./dashcaddy-api/package.json', JSON.stringify(pkg, null, 2) + '\n');
 "
+# Keep root VERSION in sync with package.json — otherwise downstream tooling
+# (installer, status page, rollback checks) reads a stale version.
+echo "$VERSION" > VERSION
 
 # ── 2. Rebuild status frontend so dist/*.js matches source ────────────────
 if [[ -f status/build.js ]]; then
@@ -60,7 +63,7 @@ fi
 
 # ── 3. Commit + push ──────────────────────────────────────────────────────
 echo "[3/6] Committing + pushing"
-git add dashcaddy-api/package.json
+git add dashcaddy-api/package.json VERSION
 # Everything the build rewrites must be staged or the tarball ships stale
 # copies. status/dist/ is .gitignored (-f bypasses); index.html and sw.js are
 # tracked but get rewritten by build.js (CSP hash + SW cache tag derived from