sdk dep by tag, not escaping path

Cargo.lock

@@ -743,6 +743,7 @@ checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 [[package]]
 name = "meta-feeder-sdk"
 version = "0.1.0"
+source = "git+https://github.com/worph/meta-feeder-sdk?tag=v1.1.0#4baf81e2bf87140175b1f51f6be51a84015e361a"
 dependencies = [
  "anyhow",
  "async-trait",

feeder-plugin/musicbrainz-feeder/Cargo.toml

@@ -18,9 +18,17 @@ name = "musicbrainz-feeder"
 path = "src/main.rs"
 
 [dependencies]
-# TEMPORARY: path dep while the SDK's new rev is unpushed. Flip to:
-#   meta-feeder-sdk = { git = "https://github.com/worph/meta-feeder-sdk", rev = "<sha>" }
-meta-feeder-sdk = { path = "../../../meta-feeder-sdk" }
+# Pinned by TAG, not rev or path. The tag is the SDK's release identity, and it
+# is the one form every feeder in the fleet can be lined up on.
+#
+# ⚠ It must never go back to `path = "../../../meta-feeder-sdk"`. That resolves
+# OUTSIDE this repo, and this repo is the Docker build context — so the image
+# build died at manifest resolution with a bare "No such file or directory",
+# and, worse, this crate became unconsumable as a git dependency by anyone
+# ("no matching package named `meta-feeder-sdk`"), because a consumer's checkout
+# has no such sibling directory either. A path dep here is not a local
+# convenience; it is a defect visible to every downstream repo.
+meta-feeder-sdk = { git = "https://github.com/worph/meta-feeder-sdk", tag = "v1.1.0" }
 
 tokio = { version = "1.40", features = ["full"] }
 axum = { version = "0.7", features = ["json"] }