chore(release): bring the workspace to 0.4.8 so vgi-core republishes

[stormer78]

What

Workspace version 0.4.7 → 0.4.8. Two lines plus the lockfile; all three crates take it through version.workspace = true.

No dependency or source changes.

Why a bump rather than re-tagging 0.4.7

0.4.7 cannot be released, and not for a reason a retry fixes.

The partial v0.4.7 run uploaded vgi-core 0.4.7 and then died on the trql-client git dependency — the failure publish.yml's own header comment describes. That left crates.io in a split state:

Crate	On crates.io	In tree
vgi-core	0.4.7 — content predates signer_did / conflicting_signer_dids	0.4.8
verify-trust	0.4.6	0.4.8
did-git-sign	0.4.6	0.4.8

publish.yml skips any crate already on crates.io at the workspace version. So a second v0.4.7 tag would skip vgi-core and then build both dependents against that stale copy — and both call those two functions. That is the E0432: unresolved imports a dry run has been reporting all along.

The version number is the only thing that makes vgi-core republish, so the bump is the fix.

Verification

As far as it can go before a real upload:

• cargo publish --dry-run -p vgi-core — packages and compiles clean ✅
• cargo publish --dry-run -p verify-trust — now fails only with:

  failed to select a version for the requirement `vgi-core = "^0.4.8"`
  candidate versions found which didn't match: 0.4.7, 0.4.6, 0.4.5, ...
  

  i.e. the ordinary first-in-chain ordering, which publish.yml handles by publishing vgi-core first. No longer the stale-API error it gave at 0.4.7 — that's the signal the bump does what it needs to.

cargo fmt --all --check, cargo check --workspace, cargo clippy --workspace --all-targets -- -D warnings, cargo test --workspace (136 pass), cargo +1.95.0 check --workspace — all clean.

What tagging this unblocks

This is step 3 of the chain OpenVTC's manifest documents:

1. ✅ Registry publishes trql-client — done (0.17.0)
2. ✅ VGI swaps its git pin back to a version — done (chore(deps): move the workspace to the published head (trql-client 0.16, vta-sdk 0.35, TDK 0.13) #38, chore(deps): take trql-client 0.17 and collapse the trust-tasks duplicate #39)
3. ⬜ VGI tags → publish.yml fires → OpenVTC deletes its [patch.crates-io] block

OpenVTC currently consumes did-git-sign and vgi-core through git revs pinned to VGI main, which have to be re-pinned on every vta-sdk minor. A published 0.4.8 lets that block go away and the requirement be floored at a real release.

After merge

Tag v0.4.8 to fire publish.yml, which publishes all three in dependency order via crates.io Trusted Publishing. Left for a human to push — crates.io uploads can't be undone, only yanked.

Still outstanding and not addressed here: OpenVTC is on vta-sdk 0.34.1 / TDK 0.12 while this workspace leads on 0.35.