[spacebear21]

Release the Python, JavaScript, C#, and Dart bindings together from one signed
payjoin-ffi-<version>+payjoin-<core> tag, with one approval and one GitHub
release, instead of four tags, four workflows, and four approvals.

Why

Each binding carried its own version sequence and its own tag-triggered publish
path. Shipping a core bump meant tagging four times, approving four times, and
nothing checked that the four packages wrapped the same payjoin-ffi commit.

What changes

Three commits, each passing CI on its own:

1. Pin Dart packages to their release commit. prepare-publish.sh now stages
   the pub.dev package in a separate directory with the native crate pinned to
   the generating checkout, excluding the development Cargo overlay and
   lockfile. The staged package is what gets dry-run checked and published, so
   the rev in native/Cargo.toml no longer has to be edited by hand.
2. Align binding versions at 0.25.0. All four packages move to the
   payjoin-ffi version. 0.25.0 is above every existing sequence (Python and
   JavaScript 0.3.0, C# 0.2.0, Dart 0.3.0), so no registry sees a version go
   backwards. No API changes. payjoin-ffi/CHANGELOG.md becomes the canonical
   changelog; the language changelogs keep a short entry linking to it.
3. Release every language binding from one FFI tag. New
   bindings-release.yml verifies the signed tag, checks every manifest carries
   the tagged version (contrib/release/bindings-version.sh, also run by
   tag.sh), runs the existing language workflows through workflow_call, then
   publishes each registry from its own job. The four publish jobs wait on every
   build so they reach the release environment together and one approval
   covers all of them. A failed registry is retried with "Re-run failed jobs"
   against the same tested artifacts. One GitHub release holds every package and
   a single SHA256SUMS, with the FFI changelog section as its body.

The per-language publish jobs, tag triggers, release-version.sh readers, the
release-assets.yml and verify-tag-hygiene.yml wrappers, and the
verify-tag-version action are removed. Net diff deletes more than it adds.
a single SHA256SUMS, with the FFI changelog section as its body.

The per-language publish jobs, tag triggers, release-version.sh readers, the
release-assets.yml and verify-tag-hygiene.yml wrappers, and the
verify-tag-version action are removed. Net diff deletes more than it adds.

Design notes

• Publish jobs live in the triggered workflow rather than the language
  workflows because PyPI's trusted publisher rejects reusable workflows.
• Tagging the bindings now runs the same lockfile and changelog invariants as
  the crates, and both tag.sh and the CI verify job refuse to release bindings
  whose wrapped payjoin is not yet on crates.io, since Dart consumers build
  against it.
• Pre-releases are -rc.N only. Python spells them rcN; npm publishes them to
  the next dist-tag.
• The payjoin-ffi crate is not published to crates.io; the tag publishes only
  the language packages.

Before the first tag

Registry configuration moves with the workflow and needs a one-time update
(documented in payjoin-ffi/RELEASING.md): PyPI, npm, and NuGet trusted
publishers to bindings-release.yml with environment release; pub.dev tag
pattern to payjoin-ffi-{{version}}; and payjoin-ffi-* allowed in the tag
rules.

Testing

shellcheck, shfmt, actionlint, prettier, and codespell pass on each commit. The
version checker, invariants checker, changelog extractor, and tag.sh dispatch
were exercised locally against the tree. The workflow itself can only be proven
by the first tag push; the single-approval behaviour relies on GitHub approving
per environment per run, and is worth watching on that first release.

This description and the branch were written with AI assistance (Claude Code)
and reviewed by me.

Reviewer: @benalleng or @chavic

Pull Request Checklist

Please confirm the following before requesting review:

• I have completed the local AI review, or disclosed I wasn't able to in the body of this PR.
• I have named one reviewer in the body of this PR.
• I have read CONTRIBUTING.md and rebased my branch to produce hygienic commits.

[coveralls]

Coverage Report for CI Build 38438516368

Coverage remained the same at 87.494%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	17848
Covered Lines:	15616
Line Coverage:	87.49%
Coverage Strength:	319.55 hits per line

---

💛 - Coveralls

[benalleng]

uTACK 00d9588

Nice that we can just use a single payjoin-ffi-<version>+payjoin-<core> tag to release them all at once.

Read through the scripts and actions to the best of my ability but I really think we need to YOLO a release at some point to actually test.

[benalleng]

Should we try to get the registry configuration locked down before merge?

[benalleng]

I think this is a duplicate wait for verify-tag I don't know if this actually does anything to make it different from the other workflows though since they block on verify-tag above