fix(release-plz): cascade rust crate bumps into wasm crate

[Firaenix]

Summary

Closes the gap that surfaced on #52, where release-plz bumped rust/Cargo.toml to 0.0.14 but left wasm/Cargo.toml and wasm/package.json at 0.0.13 — the existing sync step then "synced" wasm/package.json to the (stale) wasm crate version.

release-plz cascades a bump from crate A → crate B by editing B's manifest (the version = "..." constraint on its dep on A). With a path-only dep (bullet-rust-sdk = { path = "../rust" }), there's no version field to edit → no manifest change → no cascade → no wasm bump.

This PR adds a versioned path dep via workspace.dependencies so the version lives in one place and release-plz maintains it:

# Cargo.toml
[workspace.dependencies]
bullet-rust-sdk = { path = "rust", version = "0.0.13" }

# wasm/Cargo.toml
bullet-rust-sdk = { workspace = true }

On every release PR going forward:

1. release-plz bumps rust/Cargo.toml
2. release-plz updates workspace.dependencies.bullet-rust-sdk.version to match
3. wasm's manifest changed → release-plz bumps wasm/Cargo.toml
4. The sync step in release-plz.yml mirrors that into wasm/package.json
5. After merge, the v<version> tag triggers npm-publish.yml against an @bulletxyz/sdk-wasm at the correct version

Test plan

• cargo check --workspace clean
• After merge, the next release-plz PR includes bumps to rust/Cargo.toml, wasm/Cargo.toml, wasm/package.json, and the workspace.dependencies version, all to the same value

🤖 Generated with Claude Code

---

Note

Low Risk
Low risk: only Cargo manifest dependency metadata changes to improve automated version bumping; no runtime code or build logic is modified beyond dependency resolution.

Overview
Ensures release-plz can cascade version bumps from the Rust crate into the WASM crate by introducing a versioned path dependency for bullet-rust-sdk in workspace Cargo.toml.

Updates wasm/Cargo.toml to consume bullet-rust-sdk via workspace = true instead of a path-only dep, so the dependency version constraint is maintained centrally and will change on release PRs.

^{Reviewed by Cursor Bugbot for commit 41cb070. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cubic-dev-ai]

No issues found across 2 files

_{Tip: cubic could auto-approve low-risk PRs like this, if it thinks it's safe to merge. Learn more}