Branch protection vs bot version-sync PRs: required rust contexts never run on Cargo-only diffs

[macanderson]

Context

Main now requires fmt + clippy + test and cargo deny + cargo audit. The bot/version-sync PRs (e.g. #264) change only Cargo.toml/Cargo.lock and don't trigger the rust workflow (path filters / [skip release]), so the required contexts never report and the PR is unmergeable without --admin — #264 had to be admin-merged on 2026-07-21.

Task

Pick one:

1. Remove the path filters so the rust workflow runs on Cargo-only diffs (cheap: version bumps compile-check fast with a warm cache), or
2. add a lightweight required-checks-satisfier job that runs on Cargo-only diffs and reports the same contexts, or
3. exempt the bot branch via auto-merge with admin privileges in the release workflow itself.

Acceptance

• The next bot/version-sync PR merges without manual --admin.