fix(ci): build and test the Rust crate on every PR

[spacedevin]

The gap

The deckfile crate is emitted from the same src/index.tish as dist/deck.js. That shared origin is the entire mechanism keeping the JS host and tish-gba's build-time bake from drifting.

CI never built it.

So a change that broke the rust-lib emit — or, worse, one that made the two targets parse the same .deck file differently — would have gone unnoticed until release, or until a consumer hit it. The guarantee this whole effort is built on was asserted, not tested.

Fix

A rust_crate job that:

• emits the crate from the tish the package declares
• runs cargo test — the same conformance corpus the JS build is checked against, so both targets are held to one contract on every PR
• runs cargo publish --dry-run, so a crate that can't be packaged fails on the PR instead of at publish time

release now depends on it: a broken crate can't be released.

Also: re-lands the tish 3.2.2 bump onto a release

That change merged as chore:, which isn't release-triggering. The push failed this repo's own "require incremental release" gate and left the bump untagged — v1.2.0 is the last prerelease and doesn't contain it.

It should have been fix: from the start: the old >=2.43.0 floor declared support for tish versions that cannot emit the crate at all. This commit is typed fix:, so the next prerelease carries both it and the 3.2.2 bump sitting on main.

Verification

Ran the new job's steps locally:

npm run build:rust        deckfile — 42 exported fns + typed facade
cargo test                4 passed
cargo publish --dry-run   Packaged 30 files, 39.8 KiB compressed