Stage the xtask manifest in the release commit

[vjovanov]

Auto bump has failed on its last three runs — 2026-08-17, 2026-08-24, and a dispatch today — always at release.yml's Verify checked-in package versions step, and always before the publish step, so nothing was ever released and nothing was ever published in error.

error: xtask/Cargo.toml internal dependency requirement is stale:
{ package = "rhei-plan", path = "../crates/rhei-core", version = "=0.3.0" }

scripts/set-release-version.py bumps that pin correctly. It goes out of its way to, and its docstring says exactly why:

xtask lives outside crates/, so a plain glob there silently leaves its pins at the old version and the bump stops resolving.

The release commit in auto-bump.yml then staged Cargo.toml crates/*/Cargo.toml Cargo.lock packages docs/changelog.md docs/changelog — the plain glob that docstring warns about. So the bump landed in the runner's working tree, was never committed, and the release-candidate branch carried the stale pin into the verifier.

Fix is to stage xtask/Cargo.toml beside the others, with the reason in a comment so the list is not trimmed back to the glob later.

Verification

Simulated both staging lists in a clone — run the bump script, stage, commit, discard anything left unstaged the way a fresh CI checkout would, then run the verifier:

### OLD git add list:
error: .../xtask/Cargo.toml internal dependency requirement is stale: ... version = "=0.3.0"
### NEW git add list (with xtask/Cargo.toml):
verify: PASS

Two stale release-candidate/v0.3.1-* branches are left on the remote from the failed runs; the cleanup only runs after a successful publish. Deleting them separately.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ANPWuKoibZ6NS84tJxeDC8