feat: secrets which prints the manifest version (EGB-700)

Completes EGB-700 — the store-format line (format: vN) shipped in v0.6.0.0;
this adds the manifest schema version to the `which` manifest header
(version N, validated == MANIFEST_VERSION by _check_manifest_file). Now a
single `secrets which` surfaces both the store format and the manifest
version for the dual-format debugging window. 1 bats test. Suite 237/237.

test/manifest.bats

@@ -97,6 +97,14 @@ load test_helper
   [[ "$output" == *".env"* ]] || false
 }
 
+@test "which prints the manifest version (EGB-700)" {
+  create_project_dir manifestver
+  "$SECRETS_BIN" add .env >/dev/null
+  run "$SECRETS_BIN" which
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"version 2"* ]] || false
+}
+
 @test "malformed .secrets.json dies with a directed error naming the file" {
   create_project_dir addproj
   echo '{ not json' > .secrets.json