release: 0.0.5.0 on spec codegen 0.0.19.2

[scarmuega]

Cuts 0.0.5.0 for both packages and moves the pinned spec codegen to the current Hackage release.

Two commits, kept separate so they can be reviewed independently:

1. fix(deps) — stack.yaml extra-dep utxorpc-0.0.19.0 → 0.0.19.2
2. chore — version: in client/utxorpc-client.cabal and server/utxorpc-server.cabal, 0.0.4.1 → 0.0.5.0

They're in one PR because the release exists for the dependency move — cutting 0.0.5.0 while still building against 0.0.19.0 would ship the drift rather than close it.

The codegen pin

utxorpc on Hackage is at 0.0.19.2; stack.yaml pinned 0.0.19.0. The cabal bounds (utxorpc >= 0.0.19 && < 0.0.20) already admitted the newer patch, so this changes what CI and local builds actually resolve, not what the published package constrains.

The pantry hash was computed from Hackage rather than guessed. Method verified against the existing pin first: SHA256 of utxorpc-0.0.19.0/utxorpc.cabal reproduces 564db9f0…,2466 exactly as committed, so the same computation for 0.0.19.2 giving 8896938526a85abbc1fa508e10dc7493b8cdd7ea56775644e53f2373deefecb7,2466 is trustworthy. (Same byte length is expected — the version strings are equal-length.)

Version bump

Both packages must carry the same version — release.yml's verify job checks the tag against both cabal files and fails if either disagrees. 0.0.5.0 rather than a patch because the spec dependency moved a minor (0.0.18 → 0.0.19) in the already-merged #9/#11, which has never been released.

Note the release tag must be v0.0.5.0. The haskell carve-out in the umbrella contract (§3) keeps these packages on independent 0.0.x numbering, and the tag must match the cabal version exactly.

Pre-existing issue, deliberately not fixed here

stack.yaml.lock still records utxorpc-0.0.18.1 — it was never regenerated when #11 moved stack.yaml to 0.0.19.0. So the lock was already stale before this PR and remains so after it; stack detects the mismatch and regenerates at build time, which is why CI stayed green.

Left alone because regenerating it needs stack to actually run, and doing it by hand would mean hand-writing pantry-tree hashes. Worth a follow-up that runs stack build and commits the result.

What this unblocks

Hackage currently serves utxorpc-client/utxorpc-server 0.0.4.1, built against codegen 0.0.18. This is the last piece before tagging v0.0.5.0 puts both on 0.0.19.2 — the same spec version rust, go, python and dotnet now ship against.

🤖 Generated with Claude Code