Add CI and release automation for the Rust crate

[scouten-adobe]

What happened

The Rust crate has no CI, no release workflow, no tags, and no documented release process. Every crates.io release (0.1.0 through 0.2.2) was published by hand, with nothing recorded in git.

That's why trustmark 0.2.2 is currently unbuildable. It pins ort =2.0.0-rc.8, and ort-sys downloads prebuilt ONNX Runtime binaries from a pyke-hosted CDN at build time. Those binaries are gone for older release candidates. Nothing was yanked on crates.io, so there was no signal — the crate just stopped building.

main already contains the fix (0.3.0, ort rc.12) but it was never released.

What's here

Automation

• .github/workflows/rust-ci.yml — build and test on Linux/macOS/Windows, rustfmt, clippy with -D warnings, an MSRV check that reads rust-version from Cargo.toml, and a cargo publish --dry-run packaging check. Path-filtered to rust/, and the ~230 MB of ONNX models are cached.
• .github/workflows/rust-release.yml — triggered by a rust-v* tag. Verifies the tag matches rust/Cargo.toml, confirms the version isn't already on crates.io, tests, packages, publishes via crates.io Trusted Publishing (no stored token), and opens a GitHub release. Supports a manual dry run.

Documentation

• rust/RELEASING.md — the automated process, the manual fallback with exact commands, the one-time Trusted Publishing setup, and an explicit writeup of the ort release-candidate risk so the next person recognizes this failure mode immediately.
• rust/CHANGELOG.md — entries for 0.1.0 through 0.3.0, reconstructed from commit history.
• rust/README.md — pointers to both.

One code change

• src/bits/bch.rs: repeat().take() → repeat_n(). A newer clippy flags this, and CI gates on warnings.

Validation

Run locally against the full set of gates the CI workflow uses:

• cargo fmt --all -- --check — clean
• RUSTFLAGS="-D warnings" cargo clippy --workspace --all-targets --all-features — clean
• cargo test --workspace --locked — 24 tests + 1 doctest pass
• cargo publish --dry-run --locked — packages successfully

Both workflow files parse as valid YAML, and the shell logic in the release workflow (version extraction, MSRV extraction, published-version check) was executed locally and produces the expected results.

Follow-up needed

1. Publish 0.3.0 manually, since the automation can't publish until it's on main. rust/RELEASING.md has the exact command sequence.
2. Configure Trusted Publishing on the crates.io crate settings before the first automated release: repository adobe/trustmark, workflow rust-release.yml, environment crates-io. A CARGO_REGISTRY_TOKEN secret is a documented alternative.
3. Tag rust-v0.3.0 at the release commit so the history isn't lost for this version either.