fix(workspace): restructure into a true sibling Cargo workspace

[jpage-godaddy]

Summary

• Fixes the recurring release-please bug where cli-engine-macros's version gets silently force-synced to match cli-engine's, even with zero commits of its own (seen again in chore: release main #74, after fix(workspace): drop redundant "." self-reference from workspace members #75's "." self-reference fix only removed a warning, not the actual behavior).
• Root cause, confirmed by reading release-please's own source (src/strategies/rust.ts) and tracing two consecutive release-please-action run logs: any time the manifest release-please reads for a release path has both [package] and [workspace] in the same file, it unconditionally forces every [workspace] members entry's version to match — regardless of commits, regardless of the cargo-workspace plugin, regardless of release-please-config.json's independent per-package versioning. Our root Cargo.toml was exactly that shape (cli-engine's own package + [workspace] members = ["cli-engine-macros"]), so this fires on every release.
• Fix: move cli-engine's package into its own cli-engine/ subdirectory as a true sibling of cli-engine-macros/, and make the repo root a pure virtual [workspace]-only manifest. Traced Rust.buildUpdates() for a manifest with no [workspace] section — it takes the safe "single crate found, updating Cargo.toml" branch; the buggy branch can no longer trigger.

What moved / changed

• src/, tests/, examples/, docs/, CHANGELOG.md, Cargo.toml → all moved into cli-engine/ via git mv (100% renames, history preserved).
• New root Cargo.toml: workspace-only, resolver = "3" (a virtual workspace doesn't auto-infer this from an edition-2024 member the way a non-virtual root does — verified in a scratch workspace, confirmed the warning/behavior change), [workspace.lints.*] moved here verbatim.
• cli-engine/Cargo.toml: cli-engine-macros path dependency → ../cli-engine-macros (sibling, not nested); readme → ../README.md (verified Cargo packages a readme outside the crate directory correctly).
• cli-engine/LICENSE: copied so cargo publish still bundles a license file (previously implicit since LICENSE and Cargo.toml shared a directory).
• release-please-config.json / .release-please-manifest.json: package key "." → "cli-engine" (component/tag name unaffected — releases still tag as cli-engine-vX.Y.Z).
• .github/workflows/ci.yml and release.yml: the two cargo publish steps that ran at repo root now use -p cli-engine explicitly (a virtual workspace has no default package to publish; verified cargo publish with no -p in a multi-member virtual workspace would otherwise try to publish every member in one shot). Other steps (fmt --all, check/clippy/test/doc --all-targets) are left as bare workspace-wide commands — cli-engine-macros now gets covered by them too, which it silently wasn't before.
• Doc wording in AGENTS.md, README.md, CONTRIBUTING.md, and cli-engine/docs/design.md updated to describe the new workspace shape and fix relative links.

Test plan

• cargo generate-lockfile reverted (it does a full fresh resolve, not what we want) — used cargo check instead; confirmed Cargo.lock has zero diff (path deps don't encode filesystem paths)
• cargo fmt --all --check
• cargo clippy --all-targets -- -D warnings (+ --features pkce-auth)
• cargo test --all-targets (+ pkce-auth) — all passing, 0 failures
• RUSTDOCFLAGS='-D warnings' cargo doc --no-deps (+ pkce-auth) and cargo test --doc (+ pkce-auth)
• cargo rustdoc --lib -p cli-engine -- -W missing-docs — zero missing docs
• cargo package --list -p cli-engine — confirms LICENSE and README.md (via ../README.md) are correctly bundled
• cargo publish --dry-run -p cli-engine and cd cli-engine-macros && cargo publish --dry-run — both succeed, correctly resolving the path dependency
• After merge: watch the next release-please Action run's log for the Rust strategy trace — should now show "single crate found, updating Cargo.toml" for cli-engine instead of "found workspace with N members, upgrading all"

🤖 Generated with Claude Code