[AAASM-2897] 📝 (runbook): Document the auto-bump 3-crate pin PR

[Chisanan232]

Description

Add a new section to docs/release/RUNBOOK.md documenting the automatic
shared-crate pin bump PR that agent-assembly's release.yml
(update-python-sdk-ffi-pin job) auto-opens on this repo after each
release. The section clarifies that the bot PR bumps all three git-SHA
pins (aa-core, aa-proto, aa-sdk-client) in
native/aa-ffi-python/Cargo.toml to a single shared SHA (per ADR 0002 /
AAASM-2559), that merging it does not republish to PyPI (the bump is
source-sync only), and gives timing guidance to merge it before the next
agent-assembly tag is cut to avoid one-cycle source lag. Symmetric to the
node-sdk sibling. Cross-references agent-assembly's RUNBOOK sections 3
and 8.

Type of Change

• ✨ New feature
• 🔧 Bug fix
• ♻️ Refactoring
• 🍀 Performance improvement
• 📚 Documentation update
• 🚀 Release

Breaking Changes

Does this PR introduce any breaking changes?

• No
• Yes (please describe below)

Related Issues

• Related JIRA ticket: AAASM-2897 (parent AAASM-2894)
• Related GitHub issues: #XX

Testing

Describe the testing performed for this PR:

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No tests required (explain why)

Documentation-only change to docs/release/RUNBOOK.md; no code paths affected.

Checklist

• Code follows project style guidelines
• Self-review completed
• Comments added for complex logic
• Documentation updated if needed
• All tests passing

[Chisanan232]

Claude Code review — AAASM-2897

1. CI state

Green + mergeable: Analyze (python) ✓, Build documentation (PR, no deploy) ✓; deploy jobs correctly skipped (repository_dispatch-gated per AAASM-2868). Scope: 1 file (+25/−0).

2. Scope vs AAASM-2897

AC	Status
New section documenting the agent-assembly update-python-sdk-ffi-pin bot PR	✓ "## 5. Automatic shared-crate pin bump (from agent-assembly)"
Bumps all 3 pins (aa-core/aa-proto/aa-sdk-client), one shared SHA per ADR 0002 / AAASM-2559	✓ explicitly stated
Merging it does NOT republish to PyPI (trigger explanation)	✓ repository_dispatch + workflow_dispatch, "never on push"
Source-sync-only (maturin from-source) + merge-before-next-tag	✓
Cross-link to agent-assembly RUNBOOK §3/§8	✓

3. Technical accuracy

The 3-shared-SHA / ADR 0002 detail is the correct python-side distinction vs node's single pin. The maturin from-source build framing matches the actual release-python.yml (maturin-action × 5). Appended cleanly as a new tail section — no renumber needed.

Verdict

Ready for approval and merge. Cleanest of the three (pure append). Sister to node-sdk #129.

— Claude Code