fix: keep release candidates off crates.io

[tisonkun]

Summary

• Prevent release-candidate tags and manual workflow runs from publishing unapproved packages to crates.io; RC tags validate the unchanged final-version package with cargo publish --dry-run.
• Remove the synthetic ${VERSION}-rc.${RC} Cargo version, manifest rewrite, and --allow-dirty path from the release workflow and runbook.
• Add the 2026-09-04 dates for v0.7.0 and v0.7.1, and record that v0.7.0 was a yanked non-ASF release.

Design Notes

ASF release candidates are identified by the signed RC tag and the ASF staging directory, not by a separately versioned crate. The publish job runs only when the pushed ref exactly matches the final v${VERSION} tag produced after the release votes.

Validation

• cargo x check
• cargo x test --no-capture
• RUSTUP_TOOLCHAIN=1.86.0 cargo x test --no-capture
• cargo x semver --release-version 0.7.2
• cargo publish --package asyncband --locked --dry-run
• RUSTDOCFLAGS="-D warnings --cfg docsrs" cargo +nightly doc --workspace --all-features --no-deps
• typos
• hawkeye check
• Release workflow YAML parse and git diff --check

cargo x lint passed Clippy and rustfmt before the local Taplo 0.10.0 process hit its known macOS system-configuration NULL-object panic; the remaining lint checks were run separately as listed above.