Centralize shared Cargo dependencies at the workspace root

[Teakowa]

Goal

Make the workspace root the authoritative place for shared Cargo dependency versions and shared path/source configuration, while member crates declare only which dependencies they consume and any crate-specific feature additions.

Context

Wright is already a multi-crate Cargo workspace and already uses [workspace.dependencies] for the canonical workshop-rs pin, but most third-party dependencies and internal path dependencies are still versioned/configured independently in member Cargo.toml files.

This creates unnecessary duplication across crates such as wright-core, wright-cli, and other workspace members, and makes dependency upgrades/reviews harder than necessary. Cargo supports inheriting shared dependencies through dependency.workspace = true.

The existing exact workshop-rs dependency pin is an intentional cross-repository contract and should remain authoritative at the workspace root.

Scope

• Inventory dependencies repeated across multiple Wright workspace members.
• Move shared third-party dependency versions and common source configuration into root [workspace.dependencies].
• Move shared internal Wright crate path declarations into root [workspace.dependencies] where doing so improves consistency.
• Update member manifests to use *.workspace = true for dependencies owned by the workspace root.
• Keep crate-specific dependency features or configuration local when they genuinely differ between consumers.
• Preserve the current workshop-rs exact-version policy and dependency boundary.
• Keep dependency ownership readable: the root owns shared version/source policy; each member still declares the dependencies it actually uses.

Non-goals

• Changing Wright's repository or crate architecture.
• Publishing internal crates independently.
• Changing public APIs or runtime behavior.
• Broad dependency upgrades unrelated to this normalization.
• Loosening cross-repository version contracts such as the current workshop-rs pin.

Acceptance criteria

• Repeated shared dependency versions are no longer duplicated across member manifests where one workspace-level declaration is sufficient.
• Shared internal path dependencies use workspace inheritance where appropriate.
• Member manifests remain explicit about which dependencies each crate consumes.
• Crate-specific feature differences remain representable without duplicating shared version/source policy.
• cargo check --workspace and the repository's normal test/lint gates pass.
• Cargo.lock does not contain unintended dependency-resolution changes caused by unrelated upgrades.
• No public behavior or release contract changes as a consequence of this cleanup.

Planning notes

Treat this as dependency hygiene, not an architecture migration. Prefer a small mechanical change backed by the existing Cargo workspace model. Do not use the cleanup as an excuse to restructure crates or alter cross-repository ownership boundaries.