firmware-v0.11.0

ci(repo): Publish to crates.io via trusted publishing

Publishing has been broken since 2026-07-28. Commit e084138 removed the
`env:` block that mapped a stored CARGO_REGISTRY_TOKEN secret into the
publish step, but nothing replaced it, so `cargo publish` failed with
"no token found" on application-v0.8.0 and internal-v0.7.0. The secret
itself is gone too; GH_PAGES_TOKEN is now the repository's only secret.
Every release since has been published by hand within minutes of the
failed run.

Restore automated publishing without reintroducing a stored credential.
The job requests `id-token: write` and rust-lang/crates-io-auth-action
exchanges the GitHub JWT for a short-lived crates.io token that its post
step revokes when the job ends. CARGO_REGISTRY_TOKEN stays as the
environment variable cargo reads to receive a credential, but its value
is now that ephemeral token rather than a secret; the action exposes the
token only as a step output and sets no environment variable itself.

Trusted publishing is configured per crate, so the publisher is
registered on crates.io for all six published names with a blank
environment. Job-level permissions replace rather than merge with the
workflow-level block, so `contents: read` is restated alongside
`id-token: write`.

This mirrors the OIDC trusted-publishing setup release-pyco.yml already
uses for PyPI.

Note that release-crates.yml runs as it existed at the tagged commit, so
the pre-existing internal-v0.7.0 tag must be deleted and re-pushed
against this commit rather than merely re-run.

Assisted-by: OpenCode:claude-opus-5
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>