refactor: #54 edtf-postgres becomes a workspace member

[CarlAllenn]

Deletes the special-casing #54 was built to work around, rather than adding more of it.

The premise was wrong

edtf-postgres sat outside the workspace because a member's [profile] is ignored, and the root profile is wasm-tuned (opt-level = "z", strip = "symbols") while a Postgres extension needs speed and its symbol table intact.

That constraint is real. What I had asserted — that it was unfixable — was not. Cargo takes per-package profile overrides, and opt-level and strip are both overridable; only panic, lto and rpath are not, and none of those need to differ here (root already sets lto = "fat", matching, and panic defaults to unwind for both).

Proven in a single build:

edtf_core:     opt-level=z   strip=symbols     ← workspace default
edtf_postgres: opt-level=3   strip=<none>      ← package override

The layout

default-members holds the five pure-Rust crates, so bare cargo build/test/clippy need no $PGRX_HOME and never hit the mutually-exclusive pg14–pg18 features. Verified: cargo check --all-features --all-targets passes with no Postgres present.

This is what established pgrx projects do. ParadeDB sets default-members = ["pg_search", "tokenizers"] with the same rationale in a comment; pgvectorscale keeps its extension a member too. Both put the macOS linker flags in the root .cargo/config.toml — because Cargo "does not read config files from crates within the workspace", so a crate-local one silently stops applying to anything run from the root. pg_search has no .cargo/ at all.

What this deletes

• The hand-bump, check-version-drift.sh, and the lint:versions gate — release-plz now owns version, tag, changelog and release via version_group
• The crate's own Cargo.lock and .cargo/config.toml
• 40 lines of lint config mirrored from the root because it could not inherit
• The postgres branch in publish-crates.sh and the dual-workspace handling in package-all.sh

semver_check = false for it: cargo-semver-checks builds the crate, which needs $PGRX_HOME, and its contract is its SQL surface, not a Rust API — the lib target exists only because pgrx requires one.

The finding that matters most

cargo-deny had never audited this crate's ~150 dependencies. The gate runs over the workspace; the crate wasn't in it. A published crate has sat outside the supply-chain gate since it shipped.

Bringing it in surfaced an unmaintained advisory (serde_cbor via pgrx — informational, not a vulnerability; patched = [] because there is nothing to patch; tracked upstream at pgrx#524), three permissive licences, nine duplicate versions, and fifteen build scripts. Each is recorded with a reason, and unused-ignored-advisory = "deny" plus -D unmatched-skip mean every entry fails CI the moment upstream moves.

None of this is new exposure. It was invisible.

Two things found by running it

lefthook.yml carries its own copies of the clippy and test commands, so the Taskfile sweep missed them — --workspace --all-features there hit the pg-feature clash on push. Fixed.

Dropping --workspace then dropped edtf-postgres out of clippy entirely. It cannot rejoin the workspace gate — linting it needs $PGRX_HOME and exactly one pg feature — so it is now linted in ci.yml's postgres job, against every Postgres major, at the same -D warnings tier as everything else.

Verified locally

cargo pgrx test pg18 in the exact CI form — 6 passed, 13 SQL entities discovered. cargo package with the verify build, exact CI form — clean. cargo package -p edtf-postgres yields the same dependency set as the old standalone lockfile (225 → 227; wasm-bindgen was already there via whoami → web-sys). task lint --force green. cargo deny check green. task pg:lint green.

Refs #54