chore(release): check dpp-vocab in the semver gate

docs/governance/RELEASE.md

@@ -63,9 +63,11 @@ order:
 10. `dpp-vc` (depends on dpp-domain + dpp-crypto)
 11. `dpp-plugin-sdk` (depends on dpp-plugin-traits + dpp-rules)
 
-`dpp-vocab` is new in 0.17.0 and has never been published. It has no baseline on
-crates.io, which is why `just semver` excludes it — delete that exclusion once
-this release has shipped it once.
+`dpp-vocab` was first published in 0.17.0. Until then `just semver` excluded it,
+because a crate with no crates.io baseline has nothing to diff against; that
+exclusion has been removed. **A new crate needs the same treatment exactly
+once** — exclude it for its first release, then put it back. Leaving it out is
+how a crate ends up with nobody checking its public API.
 
 `dpp-tests` is `publish = false` and is not published, but it is still lockstep-
 versioned with everything else. `cargo-release` handles publish ordering

justfile

@@ -67,10 +67,12 @@ audit:
 # to match CHANGELOG's `### Breaking` section, which is step 3 of the
 # pre-release checklist in docs/governance/RELEASE.md.
 #
-# `dpp-vocab` is excluded because it has no baseline — it is new in this cycle
-# and has never been published. Delete the exclusion once it has shipped once.
+# Every publishable crate is checked. `dpp-vocab` was excluded until 0.17.0
+# because it had no crates.io baseline to compare against; it shipped in that
+# release, so the exclusion is gone. A crate left excluded is a crate whose API
+# nobody is checking, which is the same silence this recipe exists to break.
 semver:
-    cargo semver-checks check-release --workspace --exclude dpp-vocab --release-type patch
+    cargo semver-checks check-release --workspace --release-type patch
 
 # Build documentation (warns on missing docs)
 doc: