feat: secrets which prints the manifest version (EGB-700)

Completes EGB-700 — the store-format line (format: vN) shipped in v0.6.0.0;
this adds the manifest schema version to the `which` manifest header
(version N, validated == MANIFEST_VERSION by _check_manifest_file). Now a
single `secrets which` surfaces both the store format and the manifest
version for the dual-format debugging window. 1 bats test. Suite 237/237.

secrets

@@ -1918,7 +1918,10 @@ cmd_which() {
   local json_manifest="$PWD/$SECRETS_JSON_NAME"
   if [ -e "$json_manifest" ]; then
     _check_manifest_file "$json_manifest"
-    echo "manifest ($SECRETS_JSON_NAME at $json_manifest):"
+    # EGB-700: surface the manifest schema version (validated == MANIFEST_VERSION
+    # by _check_manifest_file above) alongside the store format printed earlier.
+    local mver; mver=$(jq -r '.version // "?"' "$json_manifest")
+    echo "manifest ($SECRETS_JSON_NAME at $json_manifest, version $mver):"
     local entry
     while IFS= read -r entry; do
       [ -n "$entry" ] || continue

test/manifest.bats

@@ -97,6 +97,14 @@ load test_helper
   [[ "$output" == *".env"* ]] || false
 }
 
+@test "which prints the manifest version (EGB-700)" {
+  create_project_dir manifestver
+  "$SECRETS_BIN" add .env >/dev/null
+  run "$SECRETS_BIN" which
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"version 2"* ]] || false
+}
+
 @test "malformed .secrets.json dies with a directed error naming the file" {
   create_project_dir addproj
   echo '{ not json' > .secrets.json