Make a release bump across consumers one step (six manual pins today)

[jstet]

Every formtransform release has to be picked up by hand in about six places, in three repos:

Consumer	Pin
formulaid	package.json (npm tarball URL)
formulaid	scripts/build_skill.sh: cdl-survey-types-<ver>.tar.gz + SHA-256
formtransform-app	package.json (npm tarball URL)
formtransform-app	tests/formtransform-fixtures.json (fixtures tarball + sha256)
qwacback	ddi-emitter/package.json (npm tarball URL)
qwacback	.registry-version + docker-compose.yml schematron-worker image tag

Only qwacback checks its pins against each other in CI (scripts/check-registry-version.sh). Today all are on v0.7.1, but a missed pin means, for example, that FormulAid validates against a different registry than qwacback converts with.

Options

1. Release workflow opens bump PRs in the three repos (a repository_dispatch or a small job using a token), each updating its pins and checksums. Consumers still review and merge.
2. Renovate with custom regex managers for the tarball URLs and the .registry-version / image tag.
3. At minimum, a release checklist in the README listing the pins above, plus a script per consumer (bump-formtransform <ver>) that rewrites URLs and checksums.

Option 1 fits best: the release already knows the version and the asset SHA-256s.

Found while mapping the tool connections for the survey site (CorrelAid/cdl-wp-eins, /workflow).