fix(build): extract VERSION from version.go correctly in the Makefile

[swarit-stepsecurity]

Makefile:3 derived VERSION with sed 's/.*"//;s/".*//'. The greedy .*" matches through the closing quote of Version = "1.14.0", so the first expression consumes the whole value and the second has nothing to trim — VERSION has been the empty string.

Its only consumers are the two MSI targets, and both accept empty silently:

$ make -n build-msi-amd64
wix build packaging/windows/Product.wxs \
        -arch x64 \
        -d Version= \
        -out dist/stepsecurity-dev-machine-guard--x64.msi

Blast radius is local only. CI builds MSIs in test-build.yml by calling wix build directly with the version resolved in the build job, and release.yml:34 derives the tag with its own working expression (sed 's/.*"\(.*\)".*/\1/'). No shipped artifact carries the empty version — this only bites someone running make build-msi-* on their machine.

Fix

One anchored expression:

VERSION := $(shell sed -n 's/^[[:space:]]*Version[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' internal/buildinfo/version.go | head -1)

[^"]* cannot run past the closing quote, and matching Version = rather than bare Version means a doc comment or a future VersionString-style line can't be picked up by grep -m1.

Both MSI recipes now assert VERSION is non-empty. That's the part that actually matters: the reason this went unnoticed is that an empty value produced a plausible-looking build rather than an error.

Verified

• make -p | grep '^VERSION' → VERSION := 1.14.0
• make -n build-msi-amd64 → -d Version=1.14.0, -out dist/stepsecurity-dev-machine-guard-1.14.0-x64.msi
• Guard fires: temporarily blanking the const makes make build-msi-amd64 exit 1 with error: no Version found in internal/buildinfo/version.go
• Ran on BSD sed (macOS); the expression is POSIX BRE, so GNU sed on the Linux runners parses it identically. make test / make smoke in CI evaluate line 3 at parse time and are unaffected either way.

No changelog entry — build tooling only, no user-facing change.