fix(release): bump-version.sh rewrites inter-workspace dep pins (SQLR-9) (#88)

* fix(release): bump-version.sh rewrites inter-workspace dep pins (SQLR-9)

The release-pr.yml dispatch for v0.3.0 failed at `cargo build` with
`failed to select a version for the requirement sqlrite-ask = "^0.2"`
because bump-version.sh updated the package-level `version = "X.Y.Z"`
field in 11 manifests but ignored the three `version = "..."` pins
that workspace crates declare on each other (engine→sqlrite-ask,
sqlrite-mcp→engine, wasm SDK→sqlrite-ask). PR #87 patched those by
hand; this change makes the script handle them automatically.

Approach: detect any TOML line containing both `version = "..."`
and `path = "..."`, rewrite the version to the full bumped semver.
This is unambiguous in the repo (no false positives) and handles
both inline-table orderings. Future workspace crates added with the
same path+version shape get rewritten with no script changes.

The rewrite uses the full X.Y.Z[-pre][+build] form (e.g. "0.3.0",
not "0.3"), which catches drift inside a minor and works with the
prerelease-dispatch path. Visible effect on the next release PR:
the three pins flip from "0.3" to "0.3.0".

Also extends the verify loop to flag any surviving same-line
`path = ... version = ...` pin not at the bumped version, so a
future refactor that changes pin shape (e.g. multi-line deps) fails
loudly instead of silently producing a broken release branch.

Verification:
- bump-version.sh 9.9.9-test rewrites all three pins (both
  inline-table orderings).
- Re-running with the same arg is byte-exact idempotent.
- `cargo build --workspace --exclude sqlrite-desktop ...` resolves
  cleanly — the original SQLR-9 failure mode no longer reproduces.
- Verify-loop logic confirmed against a staled-pin fixture.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(release): fix off-by-one file counts in bump-version.sh banner

The header docstring said "eight Cargo.toml / pyproject.toml files,
plus three JSON manifests — eleven files total" and the footer said
"the ten-file bump". TOML_FILES has nine entries (root engine, ffi,
ask, mcp, python ×2, nodejs, wasm, desktop) plus three JSON manifests
= twelve total.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: joaoh82

scripts/bump-version.sh

@@ -6,8 +6,8 @@
 #     scripts/bump-version.sh 0.2.0
 #
 # Rewrites the version field in every manifest that carries one
-# (eight Cargo.toml / pyproject.toml files, plus three JSON manifests
-# — eleven files total). Then you run `cargo build` yourself to
+# (nine Cargo.toml / pyproject.toml files, plus three JSON manifests
+# — twelve files total). Then you run `cargo build` yourself to
 # refresh Cargo.lock. Idempotent: running twice with the same version
 # is a no-op; running twice with different versions lands on the
 # second.
@@ -84,6 +84,25 @@ for file in "${TOML_FILES[@]}"; do
     fi
     sed "s/^version = \"[^\"]*\"/version = \"${VERSION}\"/" "$file" > "$file.tmp"
     mv "$file.tmp" "$file"
+
+    # Inter-workspace dep pins — lines like:
+    #   sqlrite-ask = { version = "0.3", path = "sqlrite-ask", ... }
+    #   sqlrite     = { package = "sqlrite-engine", path = "..", version = "0.3", ... }
+    #
+    # These carry BOTH version and path because crates.io publishing
+    # rejects path-only deps (see PR #58 retrospective). The version
+    # field has to track the workspace bump or `cargo build` fails to
+    # resolve a candidate (SQLR-9; failed run for v0.3.0 hit exactly
+    # this — `failed to select a version for the requirement
+    # sqlrite-ask = "^0.2"`).
+    #
+    # Detection: any line containing both `version = "..."` and
+    # `path = "..."`. The package-level `^version = "..."` line at
+    # the top of each manifest has no `path` on it and can't match.
+    # Both inline-table orderings (version-first and path-first) work
+    # because sed acts per-line, not per-token-order.
+    sed -E '/path *= *"[^"]*"/ s/version *= *"[^"]*"/version = "'"${VERSION}"'"/' "$file" > "$file.tmp"
+    mv "$file.tmp" "$file"
 done
 
 # ---------------------------------------------------------------------------
@@ -147,6 +166,22 @@ for file in "${JSON_FILES[@]}"; do
     fi
 done
 
+# Inter-workspace pin sweep — any surviving `version = "X"` on a TOML
+# line that also has `path = "..."` and isn't already at $VERSION is a
+# pin we missed. Catches future refactors that change pin shape (e.g.
+# someone splits a long dep line across multiple TOML lines, where the
+# single-line address would no longer match).
+for file in "${TOML_FILES[@]}"; do
+    bad="$(grep -nE 'path *= *"[^"]*"' "$file" \
+           | grep -E 'version *= *"[^"]*"' \
+           | grep -vE "version *= *\"${VERSION}\"" || true)"
+    if [[ -n "$bad" ]]; then
+        echo "  ✗ $file — inter-workspace pin not at ${VERSION}:" >&2
+        echo "$bad" | sed 's/^/      /' >&2
+        FAILURES=$((FAILURES + 1))
+    fi
+done
+
 if [[ $FAILURES -gt 0 ]]; then
     echo
     echo "error: $FAILURES file(s) did not update as expected." >&2
@@ -157,5 +192,5 @@ fi
 echo
 echo "Done. Next steps:"
 echo "  cargo build    # refresh Cargo.lock with the new versions"
-echo "  git diff       # inspect the ten-file bump"
+echo "  git diff       # inspect the twelve-file bump"
 echo "  git checkout . # or back out if it looks wrong"