Okay, noob insight: the Manifest.toml should not be added to the repository of a Julia package. Instead, Pkg.jl creates it based on Project.toml. If the [compat] entries are correct in the Project.toml file, then no harm is done.
Perhaps it doesn’t hurt to emphasize in the documentation of Pkg.jl that any unexpected behavior can be avoided once you add Manifest.toml to your .gitignore, see this PR.