refactor: move version to Go source, extract in flake.nix

Define version once in cmd/oubliette/main.go and use builtins.match
in flake.nix to extract it. Add versioning guidelines to CLAUDE.md.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -14,6 +14,16 @@ SSH honeypot written in Go. See `PLAN.md` for full project plan and architecture
 - Keep code simple and focused. Refer to `PLAN.md` for design decisions.
 - When adding new config options, always add them to `oubliette.toml.example` as well.
 
+## Versioning
+
+We use **semver** (`MAJOR.MINOR.PATCH`). The version is defined in `cmd/oubliette/main.go` (`const Version`) and extracted automatically by `flake.nix`.
+
+- **Patch** (`0.1.0` → `0.1.1`): Bug fixes, minor tweaks, documentation changes.
+- **Minor** (`0.1.0` → `0.2.0`): New features, new config options, new shell types.
+- **Major** (`0.x.y` → `1.0.0`): Breaking changes to config format or public interfaces.
+
+Bump the version when merging a feature branch to master, not on every commit. While pre-1.0, breaking changes only require a minor bump.
+
 ## Git workflow
 
 - Use **conventional commits** (e.g. `feat:`, `fix:`, `refactor:`, `docs:`, `test:`, `chore:`).