chore: drive release-please version bumps from inline markers

[alukach]

What I'm changing

release-please-config.json carried seven separate JSONPath entries, one per internal crate, just to keep the version pins under [workspace.dependencies] in step with the workspace version. Adding a crate meant remembering to add an eighth entry in a file nowhere near the manifest; forgetting it leaves the new crate's pin behind at the old version, which cargo publish then rejects or, worse, resolves to a stale release from crates.io.

I first tried dropping the pins entirely, since every member uses version.workspace = true. Cargo does not allow that: both 1.92 and stable 1.98 refuse to package a path dependency without a version ("all dependencies must have a version requirement specified when packaging"). So the pins stay, and the config is collapsed instead.

Stacked on #158 (both PRs edit the same extra-files array).

How I did it

• Cargo.toml: each of the eight lines release-please must bump ([workspace.package] version plus the seven internal pins) ends with # x-release-please-version. The marker sits on the line it governs, so a new crate's entry is a copy of its neighbor and cannot be forgotten in a separate file.
• release-please-config.json: the seven toml/JSONPath entries for Cargo.toml become a single {"type": "generic", "path": "Cargo.toml"} entry. The generic updater replaces the first semver-looking string on any line carrying the marker and leaves every other line untouched, including rust-version once chore: adopt workspace lints, declare MSRV, lint Workers crates in CI #154 lands (no marker there).
• CONTRIBUTING.md: one paragraph on adding a workspace crate: pin the version (cargo requires it) and add the marker.
• .github/workflows/release.yml is unchanged. Its sed that re-pins from the tag on publish still matches these lines and remains a useful belt-and-braces for tag-driven pre-releases.

Verified with release-please's actual Generic updater (v17.9.0) run against this manifest: exactly the eight marked lines change, cargo metadata still parses the file, and cargo check --locked passes after applying both updaters at a simulated 0.7.3.

Test plan

• release-please Generic updater dry run: 8 lines changed, all marked, nothing else
• cargo metadata --no-deps on the annotated manifest
• cargo check --locked before and after a simulated release bump through both updaters

🤖 Generated with Claude Code

[claude]

Claude finished @alukach's task in 1m 19s —— View job

---

Review complete

• Gather context (PR diff, changed files)
• Review Cargo.toml marker changes
• Review release-please-config.json generic updater config
• Review CONTRIBUTING.md update
• Apply ponytail-review pass
• Post final review

✅ No blocking issues — safe to merge.

Verified the mechanics:

• Cargo.toml: the # x-release-please-version marker is appended after the closing }/quote on all 8 lines ([workspace.package] version + 7 internal crate pins), so it's a trailing comment and doesn't change what Cargo parses — cargo metadata/cargo package still see a normal version = "..." field.
• .github/workflows/release.yml's sed patterns (^version = ".*" and the multistore[a-z-]* = {.*version = " capture) both stop at the first/last " on the line, so the appended comment doesn't interfere with the tag-driven re-pin on publish.
• release-please-config.json collapses the 7 per-crate toml/JSONPath entries into a single {"type": "generic", "path": "Cargo.toml"} entry, leaving the Cargo.lock toml entry untouched — valid JSON, and consistent with how release-please's Generic updater keys off the x-release-please-version line comment.
• CONTRIBUTING.md addition correctly instructs future crate additions to pin version (required for cargo publish of a path dependency) and add the marker on that same line.
• No docs/ references to release-please-config.json or the old JSONPath entries were found, so no additional doc updates are needed.

Nothing else in the diff touches code paths, dependencies, or CI permissions.

Simplify (ponytail) — none. This PR is itself the simplification (7 JSONPath entries → 1 generic entry); no new abstractions, dependencies, or boilerplate introduced.

---

💰 Estimated review cost: $0.23 · 1m19s · 13 turns

[github-actions]

🚀 Latest commit deployed to https://multistore-proxy-pr-159.development-seed.workers.dev

• Date: 2026-09-25T16:01:05Z
• Commit: ab8b512