Add release-plz automated release pipeline

[rubenhensen]

Summary

• Adds release-plz.toml configuring single-crate releases for irma with v<version> tags and cargo-semver-checks enabled.
• Adds .github/workflows/release-plz.yml with two jobs: release-plz-pr (maintains an open release PR with version bump + changelog) and release-plz-release (tags, creates a GitHub release, and publishes to crates.io after the release PR merges).
• Uses crates.io trusted publishing (OIDC via id-token: write) — no CARGO_REGISTRY_TOKEN secret needed.

Follow-ups before the first release works end-to-end

• Configure trusted publishing for the irma crate on crates.io (Settings -> Trusted Publishing): repository encryption4all/irmars, workflow release-plz.yml, no environment. Per crates.io's limitation, the first publish of a new crate must still be done manually — trusted publishing only works on crates that already exist on crates.io. The irma crate is owned by the original tweedegolf maintainers, so either request ownership or rename the crate (e.g. irma-e4a) and do the first manual publish yourself.
• In Settings -> Actions -> General -> Workflow permissions, enable "Allow GitHub Actions to create and approve pull requests" so the release PR can be opened.
• Cargo.toml still points repository = "https://github.com/tweedegolf/irmars"; update to encryption4all/irmars before the first publish.

Test plan

• Merge this PR and confirm the release-plz-pr job opens a "chore: release" PR.
• Merge the release PR and confirm release-plz-release creates the tag, GitHub release, and (once trusted publishing + crate ownership are in place) publishes to crates.io.

[dobby-coder]

Reviewed the diff and ran through the release-plz config against the crate layout.

Looks good

• release-plz.toml uses the right structure for a single-crate repo (the [workspace] table is release-plz's global-defaults section, not a Cargo workspace declaration — correct usage here).
• git_tag_name = "v{{ version }}" matches the existing v0.1.0 / v0.2.1 tags already on main, so release-plz won't try to retag old versions.
• semver_check = true is a nice safety net before publishing.
• Workflow split into a release-pr job and a release job is the canonical release-plz setup; permissions are correctly scoped per job.
• fetch-depth: 0 + persist-credentials: false are the recommended settings.

Minor observations (non-blocking)

• CARGO_REGISTRY_TOKEN is exported into the release-plz-pr job too. Harmless, but only the release job actually publishes, so it could be dropped from the PR job.
• id-token: write on the release job is only needed if you switch to OIDC trusted publishing on crates.io. Since the plan is to use CARGO_REGISTRY_TOKEN, it's currently unused — fine to leave for future use.
• No concurrency group on release-plz-release. Probably fine because it only fires on push-to-main after a release-PR merge, but adding one would prevent overlap if two release PRs land back-to-back.

Prerequisites are already called out in the PR body — CARGO_REGISTRY_TOKEN secret, crate ownership on crates.io (or rename), workflow permissions toggle, and the repository = "tweedegolf/irmars" URL in Cargo.toml. Nothing to add there.

Approving — this can land as-is, and the follow-ups in the description gate the first successful publish, not the merge.