packaging: pin cross-group deps to git tags behind an umbrella patch

[mfw78]

What

Repoint every cross-group nexum-*/videre-* dependency edge from an
in-tree path to its eventual git-tag form (tag = "v0.1.0"), and add
an umbrella [patch] in the root Cargo.toml that resolves those tags
back to the in-tree crates until the split repos exist. Adds the
per-group Cargo.repo.toml files (renamed to Cargo.toml at the
carve) with no cross-group [patch] of their own.

Why

D9/D10 of the split plan: git-tag pins are the cross-repo Rust dep
medium, and the monorepo stays on one workspace with the tags
neutralised by a patch until the physical carve. This is the last
in-tree step before the git-filter-repo cut — every crate's manifest
already reads its final post-carve dependency shape.

Testing

• nix develop -c cargo check --workspace --all-features
• nix develop -c cargo fmt --all --check
• nix develop -c cargo clippy --workspace --all-targets --all-features -- -D warnings
• scripts/check-venue-agnostic.sh

AI Assistance

Drafted and gated with Claude Code.

[lgahdl]

Verified this empirically (cloned the branch and ran cargo metadata --format-version=1 -v against the full graph, plus cargo metadata --locked for the lock-consistency question) rather than just reading: the umbrella [patch] table is an exact 1:1 match against every tag = "v0.1.0" edge added across all touched Cargo.toml files, no missing entries, no orphans, and all 10 cross-group crates resolve with source: None straight to their in-tree manifests — fully offline, zero "Updating git repository" lines. Cargo.repo.toml's member lists match each group's real crate set exactly (19/9/9), the swap-in mechanism is documented in two places and enforced by the pre-existing check-dep-sync.sh, no missed cross-group path = edges remain anywhere, and the lock file needs no changes since the resolved graph shape is unchanged by the path→git+patch swap.

One real, if minor, thing worth a look — a test-coverage narrowing riding along in what's otherwise a pure pinning change:

[lgahdl]

This drops --all-features from the leak-detection cargo tree invocation, backed by the comment's claim that nexum-runtime is "venue-free under every feature, so the default-feature graph is a sound oracle." That claim isn't verified anywhere in this diff or linked to a check that asserts it elsewhere — it's a real reduction in what this test actually catches (all feature combinations → default only), taken on faith. If a future nexum-runtime feature ever pulls in a venue-shaped crate transitively behind a non-default feature, this test would no longer catch it. Worth linking to wherever all-features parity is actually asserted (e.g. nexum-runtime's own CI), or adding a comment pointing at the specific reason --all-features had to go (the comment mentions cargo rejecting it for out-of-workspace deps in the standalone repo, but doesn't explain why that tradeoff is safe long-term, only that it's currently necessary).