v0.18.2 — CI guard for template-pin drift

Patch release on top of v0.18.1.

What's new

A CI guard that prevents the kind of drift v0.18.1 patched. The scaffold template pin is now structurally locked to the workspace minor — silent stale pins can't ship again.

The guard

New step in .github/workflows/ci.yml:

- name: scaffold template pin tracks workspace minor
  run: |
    set -eu
    workspace=$(awk '
      /^\[workspace\.package\]/ { in_section = 1; next }
      /^\[/                     { in_section = 0 }
      in_section && $1 == "version" { gsub(/"/, "", $3); print $3; exit }
    ' Cargo.toml)
    template=$(grep -E '^rustio-admin\s*=\s*"' \
      crates/rustio-admin-cli/templates/project/Cargo.toml.tmpl \
      | head -1 | cut -d'"' -f2)
    if [ "$workspace" != "$template" ]; then
      echo "::error::Workspace version ($workspace) and scaffold template pin ($template) have drifted..."
      exit 1
    fi
    echo "OK: workspace and scaffold template both pin $workspace"

Why it matters

For three releases (0.17.0, 0.17.1, 0.18.0) the workspace bumped to a new minor while the bundled rustio startproject template kept pinning rustio-admin = "0.16.0" — a version that never existed on crates.io. Every fresh scaffold hit a registry resolve failure. The bug was silent because the template file isn't compiled — it's read at scaffold time, well after CI is done.

This guard catches the drift at the source: any PR that bumps the workspace version without bumping the template pin fails CI immediately.

Verification

Tested locally:

• In-sync (0.18.2 ↔ 0.18.2): OK: workspace and scaffold template both pin 0.18.2.
• Drift simulated (template reverted to 0.16.0): ::error::Workspace version (0.18.1) and scaffold template pin (0.16.0) have drifted. Update crates/rustio-admin-cli/templates/project/Cargo.toml.tmpl to read 'rustio-admin = "0.18.1"'. → exit 1.

This release exercises the guard at its own bump — proof the system works end-to-end.

Compatibility

• No library API change.
• No CLI surface change.
• CI workflow only.
• Drop-in upgrade from 0.18.1.