fix: make the 0.1.0 release publishable

[tisonkun]

Summary

This is a deliberately narrow final 0.1.0 audit. It keeps only issues with a reproducible release failure or a concrete user-facing ambiguity.

• state explicitly that shape derives and serde_shape attributes provide reflection metadata without implementing or changing Serde's runtime traits
• stage both publishable crates and their workspace dependency requirements at 0.1.0 in one atomic version change
• package the unpublished main and derive crates in one Cargo invocation, allowing Cargo's temporary workspace registry to verify the exact archive pair
• remove 66 lines of custom archive extraction, metadata parsing, and registry patching plus the now-unused xtask serde_json dependency

Reproduced release failure

After changing the package versions to 0.1.0, the previous cargo x package --locked failed before its custom verification logic ran:

failed to select a version for the requirement `serde-shape-derive = "=0.1.0"`
candidate versions found which didn't match: 0.0.1
location searched: crates.io index

Packaging both selected workspace crates together succeeds while the version is unpublished. Cargo places the derive archive in its temporary registry and then verifies the main archive against that exact artifact.

Review order

Each commit is independently reviewable and contains a Why: paragraph with the concrete failure or user cost.

1. docs: separate reflection from Serde runtime derives
2. chore: stage the 0.1.0 package versions
3. fix: package unpublished workspace crates together

Deliberate non-changes

The broader audit did not find evidence for changing the public graph model, adding another graph abstraction, expanding built-in coverage beyond Serde's implementations, or deleting existing behavior-boundary tests. Those changes would be speculative and increase the false-positive surface before 0.1.0.

I also did not add a separate README test crate or duplicate existing derive fixtures. The README examples compile as written, and the existing rustdoc, derive, integration, platform, MSRV, and no_std checks already cover the relevant behavior boundaries.

Validation

• cargo x build --locked
• cargo x test
• cargo x lint
• cargo x package --locked against the unpublished 0.1.0 pair
• cargo +1.85.0 x test
• cargo +1.85.0 check -p serde-shape --lib --no-default-features --target thumbv7em-none-eabihf
• cargo +1.85.0 check -p serde-shape-test-no-std --lib --target thumbv7em-none-eabihf
• README Rust examples compiled directly with rustdoc
• cargo semver-checks audit against v0.0.1; the known breaking changes are already enumerated under the changelog's Breaking changes section for the 0.0-to-0.1 transition