feat: hash-guarded dataset versioning + release scaffolding #minor

[BradenBug]

Implements the framework half of the benchmark versioning

What

• Dataset versioning module (dataset_versioning.py): a dataset_versions.yaml maps each dataset to a human-assigned semver + a sha256 of its content file. load_verified_dataset_versions recomputes and raises DatasetVersionError on any mismatch; a check/update CLI lets maintainers verify and re-stamp checksums.
• Startup guard (base.py): an opt-in dataset_versions_file ClassVar; when set, create() verifies content before load_datasets() so a service refuses to start on tampered data, and get_dataset_version() serves the declared version.
• /version field: VersionResponse gains dataset_version, populated from get_dataset_version(dataset) via an optional ?dataset= query param. (Kept on the public /version route deliberately — the version is low-sensitivity metadata already published in manifests.)
• Scaffolder: create-benchmark-service now emits check-pr-title.yaml + auto-tag-release.yaml and switches scaffolded pyproject.toml to hatch-vcs, so new services get release machinery for free.

[assert-app]

Review on Assert →

[devin-ai-integration]

Devin Review found 2 potential issues.

View 2 additional findings in Devin Review.