Direct release doesn't commit a hybrid package's Cargo.toml bump #678

Problem

In the direct-commit release flow (releasekit release without a standing PR), a hybrid package — a directory with both package.json and Cargo.toml — gets its Cargo.toml bumped on disk but not committed. The release commit and its tag carry the new package.json version and the old Cargo.toml version, and the tree is left dirty.

Why

• The version step records one update per directory. addPackageUpdate (packages/version/src/utils/jsonOutput.ts) dedupes updates by directory and lets a package.json replace an already-recorded native sibling. So a hybrid package's updates[].filePath is its package.json, never its Cargo.toml.
• Publish's prepare stage writes the sibling but doesn't stage it. For each update, stages/prepare.ts finds Cargo.toml next to filePath, calls updateCargoVersion, and adds only the synced Cargo.lock to ctx.additionalFiles. The Cargo.toml path itself is never added.
• The git-commit stage stages an explicit list. stages/git-commit.ts runs git add on input.updates[].filePath plus ctx.additionalFiles — not git add -A — so the written Cargo.toml is left out of the commit.

A pure-Rust crate is unaffected: its update's filePath is the Cargo.toml. The standing-PR flow is unaffected too: its update commits with git add -A.

Impact

The tag points at a commit whose Cargo.toml still has the previous version, while the crate published to crates.io (from the working tree) has the new one. The next run sees an uncommitted Cargo.toml change, and anything that builds from the tag gets the wrong crate version.

Proposal

• In prepare.ts, add each Cargo.toml it writes to ctx.additionalFiles, next to the lock files. That fixes it for every caller without touching the VersionOutput contract.
• Check whether a directory with package.json and pubspec.yaml has the same gap: the dedupe would also hide pubspec.yaml, and the prepare stage doesn't handle pubspecs at all. Not verified.
• Add a test of the direct-commit flow on a hybrid fixture that asserts the release commit contains Cargo.toml at the new version and the tree is clean afterwards.

Found while working on #674 (#650), which touches the same prepare stage but only for Cargo.lock.