gamut-riff declares 1.0.0 but crates.io stops at 0.1.3

[justin13888]

Found while correcting the README crates table for #425, and outside PR #526's boundary. Adjacent
to #527 but the opposite half of it, so filed separately rather than folded in: #527 is about
crates whose tags are missing though they are published; this is a crate whose manifest version
is ahead of everything published.

The gap

crates/gamut-riff/Cargo.toml:4 declares version = "1.0.0". The crates.io API for gamut-riff
returns, newest first:

version	yanked	published
0.1.3	no	2026-08-05
0.1.2	no	2026-07-21
0.1.1	no	2026-06-12
0.1.0	no	2026-06-01

So gamut-riff 1.0.0 exists only in this repository. Issue #186 (Release gamut-riff v1) is
closed, and the README's row for the crate reads stable (v1, #186) — true of the working tree,
not of anything a user can depend on. A caller writing gamut-riff = "1" gets a resolution failure;
the newest thing they can actually get is 0.1.3, a different major from the one the repository
calls stable.

It is exactly two crates, and only two

I checked every workspace crate's manifest version against the newest non-yanked crates.io version
(32 crates, cargo metadata --no-deps against the /api/v1/crates/<name>/versions endpoint,
2026-09-10). Thirty match exactly. The two that do not:

• gamut-riff — local 1.0.0, published 0.1.3. This issue.
• gamut-cmm — local 0.1.0, not on crates.io at all. Expected: Implement gamut-cmm — ICC colour management module (transform engine) #323 landed recently and the
  README already says "not yet on crates.io". Recorded here only so the survey is complete and the
  README's claim has a checked basis.

That every other crate agrees is what makes gamut-riff a defect rather than a policy: release-plz
normally publishes what the manifest declares, and here it did not.

Scope

• Establish why gamut-riff 1.0.0 was never published — whether the bump landed outside
  release-plz's history (the manual mise run bump escape hatch AGENTS.md documents), whether the
  publish step failed, or whether it was published and yanked (the API says not yanked, so this
  last is ruled out).
• Publish 1.0.0, or roll the manifest back to what the release history supports. Whichever is
  chosen, gamut-riff's README row and issue Release gamut-riff v1 #186 should end up consistent with it.
• Consider a guard: a manifest version with no corresponding published version is the same class of
  hand-maintained-number drift that README: crates table misdescribes six shipped crates and omits gamut-dng #425 (crates table), README: the Usage snippet pins gamut = "0.1", a version that was never published #523 (usage snippet) and README Releases section lists five already-published crates as awaiting their first publish #527 (release
  tags) are each an instance of. A check comparing every manifest version against crates.io would
  cover all of them at once — with a documented allowance for a crate not yet bootstrapped, which
  today is gamut-cmm alone.

Acceptance

Every publishable crate's manifest version is either published on crates.io or explicitly recorded
as awaiting its first publish, and gamut-riff's version, README row and release history agree.