ci: add crates trusted publishing workflow

[longlho]

Summary

• add a manual .github/workflows/crates-release.yml workflow for crate releases
• validate the Rust crate targets through Bazel before publishing
• default to cargo publish --dry-run and only request a crates.io OIDC token when dry_run is false

Notes

• crates.io trusted publisher setup should point at workflow file crates-release.yml
• this draft does not configure a GitHub environment claim yet

Test Plan

• ruby -e "require 'yaml'; YAML.load_file('.github/workflows/creates-release.yml')"
• git diff --check origin/main...HEAD
• bazel query '//crates/icu_skeleton_parser:icu_skeleton_parser_test + //crates/icu_messageformat_parser:icu_messageformat_parser_test + //crates/formatjs_cli:formatjs_cli_test'

Local Hook Note

• git commit without --no-verify failed because local oxfmt cannot load the missing optional package @oxfmt/binding-darwin-arm64; the commit was created with --no-verify after the checks above passed.