Add guarded Cargo trusted publishing

[konojunya]

Summary

• Add a main-only, exact-source Cargo release workflow using a pinned OIDC authentication action.
• Default to packaging and authentication verification without uploading a crate.
• Require successful exact-commit CI, expected package/version, registry-only packaged dependencies, and immutable version checks before publishing.
• Document owner configuration separately from workflow implementation; no long-lived secret is used.

Validation

• Five publication-context and workflow-boundary tests
• actionlint and whitespace validation
• Existing full repository CI remains required

No package version, released artifact, runtime behavior, or registry trust configuration is changed.