fix(release): merge engine's release with its dependents (mcp, miner)

[JSONbored]

Summary

The actual root cause of the mcp/miner v3.1.x release churn this session (#7086, #7087, #7107, #7108): engine's release and its dependents' (packages/loopover-mcp and packages/loopover-miner both carry a real runtime dependencies entry on @loopover/engine) release each landed as separate PRs/commits.

release-please's node-workspace plugin still bumps a dependent's @loopover/engine version range the moment engine's own version changes -- that part is correct and desired. But with merge: false (this repo's prior override of the plugin's own default), it does that bump on the dependent's own separate branch, not engine's. So the dependent's package.json ends up requiring an engine version that exists nowhere: not locally (engine's bump lives on a different, unmerged branch), and not on npm (it hasn't published yet). npm ci then fails with ETARGET until a human notices, manually walks engine's release through to publish, then updates the dependent's branch. That's exactly what ate hours across this session.

merge: true is the plugin's own purpose-built mechanism for this exact scenario: it combines a package with the dependents its own dependency-bump logic pulled in as candidates into one PR/commit. Engine's new version and its dependents' bumped ranges land together atomically -- npm workspaces then resolves @loopover/engine from the local checkout, which always satisfies the range regardless of npm registry publish timing or ordering. This eliminates the failure mode structurally instead of reacting to it after the fact.

packages/loopover-ui-kit has no dependency edge to any other package in this repo, so it's never pulled into the merge and keeps its fully independent release cadence -- confirmed via grep '@loopover' packages/loopover-ui-kit/package.json returning nothing.

Test plan

• npm run actionlint -- clean
• npm run typecheck -- clean (after npm run build --workspace @loopover/engine)
• JSON-validated release-please-config.json
• Confirmed via googleapis/release-please's own source (src/plugins/workspace.ts) that merge defaults to true and controls exactly this: "If multiple in-scope packages are being updated, it will merge them into a single package [PR]" -- this repo had explicitly overridden that default to false
• Config/workflow-comment-only change; not measured by Codecov. The real verification is empirical: the next time engine has an unreleased change alongside mcp/miner, release-please should open ONE combined PR instead of three separately-failing ones.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.75%. Comparing base (1b42787) to head (8e31375).
⚠️ Report is 14 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7114   +/-   ##
=======================================
  Coverage   93.75%   93.75%           
=======================================
  Files         692      692           
  Lines       68808    68809    +1     
  Branches    18781    18781           
=======================================
+ Hits        64511    64512    +1     
  Misses       3302     3302           
  Partials      995      995           

Flag	Coverage Δ
shard-1	43.79% <ø> (+<0.01%)	⬆️
shard-2	36.84% <ø> (+<0.01%)	⬆️
shard-3	33.14% <ø> (+<0.01%)	⬆️
shard-4	34.48% <ø> (+<0.01%)	⬆️
shard-5	32.29% <ø> (+<0.01%)	⬆️
shard-6	45.76% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.