Use a crates.io API token for the release workflow

[scouten-adobe]

Follow-up to #42.

Trusted Publishing needs a one-time OIDC configuration on the crates.io crate settings page. That's more ceremony than is warranted for getting 0.3.0 out, so this switches the release workflow to a plain CARGO_REGISTRY_TOKEN secret — the only setup is pasting a token into repository settings.

Changes

• Publish using the CARGO_REGISTRY_TOKEN secret instead of obtaining a short-lived token via rust-lang/crates-io-auth-action.
• Drop the now-unneeded id-token: write permission.
• Fail fast when the secret is missing. Previously a misconfigured secret would only surface after the ~230 MB model download and the full test run; now it's the first step after checkout.
• Document the token setup in rust/RELEASING.md, and keep Trusted Publishing documented as the alternative for whenever we want to stop storing a long-lived credential.

The crates-io environment is retained, and the docs now recommend storing the token as an environment secret rather than a repository secret, so it's only exposed to jobs that opt into that environment — and so a required-reviewer rule can be added later if desired.

Setup required before the first automated release

1. Create a crates.io API token scoped to publish-update, restricted to the trustmark crate.
2. Create a crates-io environment under Settings → Environments (the repo currently has none).
3. Add the token as a CARGO_REGISTRY_TOKEN secret on that environment.

Validation

• Workflow parses as valid YAML; job structure, permissions, and step order verified.
• The credential guard was exercised locally for both the set and unset cases.
• No changes to the CI workflow or crate source.