fix(rust): ensure extraDependencies overrides take precedence over bundled deps

[jsklan]

Description

Refs FER-9454

extraDependencies specified in generators.yml could not override conditional bundled dependency versions (e.g., tokio-tungstenite, reqwest-sse, pin-project). User overrides were applied inside addBaseDependencies(), but detectAndAddFeatureDependencies() ran afterward and re-added the bundled versions, reverting any user pins via the mergeDependencySpecs spread ({...existing, ...newSpec} — later call wins).

Base deps like serde, reqwest, and tokio were already correctly overridable since extras were added after them within the same method.

Changes Made

• Extracted extra dependency processing from addBaseDependencies() into a new applyExtraDependencies() method
• applyExtraDependencies() is called after both addBaseDependencies() and detectAndAddFeatureDependencies() in the constructor, ensuring user-specified versions always take precedence
• Removed dead code: generateExtraDependencies() and generateExtraDevDependencies() in RustProject.ts (private methods, never called anywhere — actual Cargo.toml rendering uses dependencyManager.toTomlSections())
• Added changelog entry (v0.31.1, rebased on top of v0.31.0 maxRetries feature)
• Removed stale ruby-sdk entry from scripts/validate-all-changelogs.sh (folder was renamed to ruby-sdk-v2, causing Validate Changelogs CI to fail on every PR)

Human Review Checklist

• Verify no other code path adds bundled deps after applyExtraDependencies() in the constructor — currently the order is: addBaseDependencies() → detectAndAddFeatureDependencies() → applyExtraDependencies() → new RustProject()
• Confirm generateExtraDependencies() / generateExtraDevDependencies() in RustProject.ts were truly dead code (private, no callers)
• Confirm removing ruby-sdk from validate-all-changelogs.sh is correct (seed/ruby-sdk no longer exists; ruby-sdk-v2 is already listed)
• Feature arrays are merged (unioned), not replaced, by mergeDependencySpecs. This is unchanged behavior — users can add features but not remove bundled ones. Only scalar properties (version, optional, etc.) are overridden.
• The extra deps logic itself is unchanged — only its call site moved. No new branching or type handling was introduced.

Testing

• Unit tests added/updated — no unit tests added; the Rust generator relies on seed snapshot tests for regression coverage
• Manual testing completed — not tested locally; relies on CI
• All seed tests pass (rust-sdk, rust-model, and all other generators)
• All CI checks pass (62/62), including Validate Changelogs

Link to Devin session: https://app.devin.ai/sessions/dd09dc3fc802408fa0d1bbe6e2e4cd19
Requested by: @jsklan

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.