fix(quasar): pin quasar deps to 623bb70 (upstream zeropod 0.3.0 regression)

[mikemaccana-edwardbot]

Summary

Pin all blueshift-gg/quasar Git deps in this repo to commit 623bb70 because the current master HEAD fails to compile (E0592 duplicate definitions for delegate / close_authority / mint_authority / freeze_authority).

Root cause (upstream)

Commit 2be2622 on blueshift-gg/quasar master (2026-05-09, "fix(derive): classify const-capacity account Vec fields") bumps zeropod from 0.2.0 to 0.3.0 in lang/Cargo.toml and Cargo.lock.

zeropod 0.3.0 starts auto-generating accessor methods for PodOption<T, PFX=4> fields. quasar's own spl/src/token.rs still carries manual implementations of those accessors with a comment that reads:

Semantic accessors for COption fields (auto-generated accessors don't cover PFX=4).

That assumption became false the moment zeropod 0.3.0 landed, so the manual impls now collide with the macro-generated ones:

error[E0592]: duplicate definitions with name `delegate`
  --> /…/quasar/spl/src/token.rs:16:10
   |
16 | #[derive(quasar_lang::__zeropod::ZeroPod)]
   |          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ duplicate definitions for `delegate`
...
64 |     pub fn delegate(&self) -> Option<&Address> {
   |     ------------------------------------------ other definition for `delegate`

Same error for close_authority, mint_authority, freeze_authority. Every tokens/**/quasar project here therefore fails to build.

Fix

Pin all blueshift-gg/quasar deps (quasar-lang, quasar-spl, quasar-metadata) to rev = "623bb70" — the last working commit on master before the zeropod 0.3.0 bump. Bisected by checking cargo check at each candidate revision.

Same source-id (matching rev) keeps trait impls consistent across the quasar crates; Cargo treats different rev/branch specifiers on the same git URL as distinct sources, which previously caused trait-resolution failures here.

Every touched Cargo.toml carries a comment explaining the pin and the unpin trigger (upstream zeropod fix landing on master).

Files

44 Cargo.toml files across basics/**/quasar and tokens/**/quasar. The basics/** projects don't pull quasar-spl so they weren't actually broken, but pinning them to the same rev keeps the whole quasar dep tree consistent and avoids future drift.

Verification

Locally ran cargo check --release --tests on three representative projects:

• tokens/escrow/quasar ✅
• tokens/token-extensions/transfer-fee/quasar ✅
• tokens/spl-token-minter/quasar ✅ (also exercises the quasar-metadata pin)

All compile cleanly (only pre-existing dead-code/cfg warnings).

Relationship to PR #23

This is a follow-up to PR #23 ("fix(ci): restrict changed-project detection to exact framework roots"). PR #23 fixes a real workflow bug; once it runs the full-project matrix on workflow-file changes, it exposes this pre-existing quasar regression. PR #23 has been cleaned up to contain only the workflow fix — no .ghaignore additions to hide the failures it surfaces.

Out of scope

tokens/token-extensions/transfer-hook/block-list/pinocchio is a WIP port (no pnpm-lock.yaml, no tests/, no build script). It needs a real port (look at the sibling block-list/native or block-list/anchor for reference), not a dependency pin or a CI ignore. Tracking separately.