[secsovereign]

This does for blvm-sdk what blvm-node#27 / blvm-protocol#7 do: main's manifests lag crates.io because Release publishes with --allow-dirty and never commits its version bump.

Evidence

• main @ d3000d8 (== tag v0.1.19): root Cargo.toml version = "0.1.13"; crates/blvm-sdk-macros/Cargo.toml version = "0.1.0".
• crates.io max_version: blvm-sdk 0.1.19, blvm-sdk-macros 0.1.19.
• Latest main run: https://github.com/BTCDecoded/blvm-sdk/actions/runs/38822865314 (d3000d8).

Changes

1. Both [package] version lines → 0.1.19. The root's blvm-sdk-macros = { path = "crates/blvm-sdk-macros" } stays a path dep on main. Cargo.lock is gitignored. No other in-repo references to the old versions.
2. ci.yml Release: new step Commit Cargo.toml version bumps, after Publish blvm-sdk and before Verify published crates / the tag step.
   • Runs only when both publish_macros and publish_sdk report published == 'true'.
   • Commits Bump version to X for release with the skip-ci marker (consensus's format).
   • Commits only the two [package] version lines: it applies the job's own awk to HEAD:<manifest> and stages the result with git update-index.
   • What stays off main: Update Cargo.toml for release also pins blvm-sdk-macros = { version = "=X", path = … } and blvm-node = "<max>", and the strip action removes [patch.crates-io]. None of that is committed. The on-disk release manifests that publish uses aren't touched.
   • Pushes with the checkout credential (GITHUB_TOKEN, contents: write; main is unprotected), the same one the tag push uses. Pushes made with GITHUB_TOKEN don't trigger workflows.
3. Review notes from node#27, handled here:
   • No ignored push failures: if pushing the bump to main fails, the step emits a ::warning annotation and a step-summary section with the unpushed commit and what to do. It doesn't fail the job, because both crates are already published and the tag / GitHub Release still need to run.
   • Tag hint: if the tag push fails, the step now prints the manual tag command at the release commit (git rev-parse HEAD, i.e. the bump commit when present). It still exits 1, as before.
   • No newline churn: there's no trailing-newline change, and the file ending is unchanged.

Run locally

• cargo metadata: blvm-sdk 0.1.19, and blvm-sdk-macros 0.1.19 resolved via the path dep.

• cargo check -j 2 in crates/blvm-sdk-macros: pass.

• cargo check -j 2 --no-default-features --lib on the root: pass.

• A full default-features cargo check couldn't build on this box: tikv-jemalloc-sys needs make, which isn't installed. CI is the full build check.

• actionlint shows no new findings compared with main, and the YAML step order was checked.

• The bump logic was run in a scratch clone against release-style manifests (version bump, =0.1.20 macros pin, stripped patch section). The commit had exactly two one-line version diffs, and the working tree was left as it was.

• Also bumps the wasmtime pin from =36.0.18 to =36.0.19 (Cargo.toml:66) for RUSTSEC-2026-0379 and 0380 (critical Cranelift miscompilations, published 2026-10-19), which cargo audit in downstream blvm CI now rejects.