fix: handle separate workspace release PRs

[flandia]

Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)

Fixes #2853 🦕

• attach each dependency-bump manifest entry to its corresponding workspace
  candidate when merge: false
• preserve the combined manifest update when workspace candidates are merged
• propagate configured release PR labels to candidates created by workspace
  plugins
• add regression coverage for separate dependency-only candidates

The workspace plugin unconditionally attached the complete
updatedPathVersions map to newCandidates[0]. This was valid after merging
candidates, but with merge: false it placed every manifest entry in the first
PR and left the other dependency-bump PRs without manifest updates.

Workspace-created candidates also did not receive the labels configured by the
manifest, making them invisible to release and open-PR discovery logic.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[flandia]

Just signed the CLA