Implement crates.io publish CI job (spec 048)

[enricopiovesan]

Summary

Add the `publish` CI job that automatically publishes all six Traverse crates to crates.io in dependency order when a `v*` tag is pushed.

Governing Spec

• `048-semver-publishing-pipeline`

Blocked by

• Implement bump_version.sh and version-guard CI job (spec 048) #513 (bump script and version-guard must merge first)
• crates.io API token must be set as `CARGO_REGISTRY_TOKEN` in GitHub Actions secrets (manual step by repo owner before this PR can be tested end-to-end)

Publish order (dependency graph)

traverse-contracts
  └── traverse-registry
        ├── traverse-runtime
        │     ├── traverse-mcp
        │     └── traverse-cli
        └── traverse-expedition-wasm

Each crate is published only after its dependencies are confirmed published. A 30-second sleep between publishes handles crates.io index propagation lag.

CI job spec

publish:
  name: Publish to crates.io
  runs-on: ubuntu-latest
  if: startsWith(github.ref, 'refs/tags/v')
  needs: [ci]   # all existing checks must pass first
  steps:
    - uses: actions/checkout@v4
    - uses: dtolnay/rust-toolchain@stable
    - name: Publish crates in dependency order
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: bash scripts/ci/publish_crates.sh

`scripts/ci/publish_crates.sh`

• Publishes each crate with `cargo publish -p `
• If `cargo publish` exits with "already uploaded" (crates.io error code for duplicate version), treats it as success (idempotent)
• If any crate fails for any other reason, exits non-zero immediately
• Prints which crate is being published and its version before each step

Definition of Done

• `scripts/ci/publish_crates.sh` exists, is executable, publishes in correct dependency order
• Idempotent: re-running on an already-published version is a no-op exit 0
• `publish` CI job added to `ci.yml`, triggers only on `v*` tag push
• `publish` job `needs: [ci]` — all existing checks must pass before publish fires
• `CARGO_REGISTRY_TOKEN` is used from secrets, never hardcoded
• Job verified by a dry-run (`cargo publish --dry-run`) on CI before the real publish is enabled
• All six crates confirmed on crates.io at the correct version after first real tag push
• `bash scripts/ci/spec_alignment_check.sh` passes
• PR body declares ````048-semver-publishing-pipeline```` in `## Governing Spec`