Cargo Git consumers fetch unrelated private host submodules

[leonardocustodio]

Problem

The Rust crates in TruAPI 0.7.0 are not published on crates.io, so downstream Rust applications naturally try an exact Cargo Git dependency at commit 48f8de6fb802cdf1f5faec591ef393fb989af073.

Cargo recursively initializes every git submodule in the dependency repository, including hosts/android, hosts/ios, and hosts/dotli. Those host repositories are unrelated to the Rust crate graph and some require organization credentials. A clean anonymous consumer therefore cannot resolve truapi / truapi-server, even though all source needed by those crates is public.

Using CARGO_NET_GIT_FETCH_WITH_CLI=true still fetches the host submodules. A downstream [patch] also does not help because Cargo fetches the original Git source and its submodules before applying source replacement.

Reproduction

From a clean machine/cache, create a package with an exact dependency such as:

[dependencies]
truapi-server = { git = "https://github.com/paritytech/truapi.git", rev = "48f8de6fb802cdf1f5faec591ef393fb989af073" }

Then run cargo metadata or cargo fetch without private GitHub credentials. Cargo attempts to initialize the unrelated host gitlinks and dependency resolution fails.

The same consumer succeeds when the relevant host entries in .gitmodules declare update = none, or when the official repository is cloned separately with --no-recurse-submodules and the Rust crates are consumed by path.

Requested packaging contract

1. Mark host gitlinks that are not required by the Rust workspace with update = none in .gitmodules.
2. Add release CI that creates a fresh external Cargo consumer, uses the release commit through an exact Git dependency, has no organization credentials, and verifies that no host submodule is initialized.
3. As the durable solution, publish truapi, truapi-server, truapi-platform, and truapi-macros with valid versioned internal dependencies. This also requires a published/versioned verifiable dependency (currently pinned to 19b03deb89b8dea484b143afc8bbe048a74bc1ff).

Acceptance criteria

• An anonymous clean-cache Cargo consumer can resolve and build the Rust crates from an exact release commit without fetching any host repository.
• Package/release CI exercises that external-consumer topology.
• The supported Rust distribution mechanism and exact provenance expectations are documented.

Brevity is temporarily using one ignored, detached, clean official checkout at the exact release SHA with submodules disabled. That avoids vendoring or modifying TruAPI, but a directly consumable Git or registry release would remove this setup layer.