fix: repair release preflight

[salasebas]

Summary

• break the same-release rustauth / rustauth-fred package-verification cycle by moving Fred cross-crate/live tests into an unpublished integration-test crate
• correct the documented publication graph and order, including the rustauth-passkey → rustauth-plugins verification edge
• add a required CI preflight that rejects publication cycles, missing packages, and dependency-order drift

Rebase note

Rebased onto main at 58319769 (#208). Main already contains the Rust 1.97 Clippy rewrite and duplicate workflow_dispatch removal originally included here, so those changes are no longer part of this PR's diff. The Integration workflow keeps #208's serialized rustauth-cli tests and this PR only replaces the Fred live-test matrix entry with rustauth-integration-tests.

Root cause

Versioned dev-dependencies in rustauth-fred are retained by Cargo during package verification. Fred therefore required the same-release rustauth facade, while the facade normally/optionally required Fred, leaving no valid clean publication order.

The documented order also placed rustauth-plugins before its versioned verification dependency rustauth-passkey.

Validation

• cargo fmt --all --check
• cargo deny check — advisories, bans, licenses, and sources pass
• env RUSTC_WRAPPER= cargo +1.97.0 clippy --workspace --all-targets --all-features -- -D warnings
• env RUSTC_WRAPPER= cargo nextest run -p rustauth-fred --all-features — 19 passed
• env RUSTC_WRAPPER= cargo nextest run -p rustauth-integration-tests --all-features — 22 passed against local Redis
• python3 -m unittest discover -s scripts/tests -p test_check_release_order.py — 5 passed
• python3 scripts/check_release_order.py — 23 publishable packages and 68 packaged workspace edges, acyclic and correctly ordered
• zizmor --offline --strict-collection --no-exit-codes .github/workflows/ci.yml .github/workflows/integration.yml — both workflows parse; only pre-existing action pin/cache findings remain
• cargo package -p rustauth-fred --allow-dirty --offline --no-verify — package succeeds and retains only the expected core/time/tokio dev-dependencies

Closes #206

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
rustauth-docs-site	Ignored		Jul 20, 2026 7:05pm