chore(cargo): crates.io metadata, exclude .planning from the crate, cargo-binstall metadata #203

Part of the 2026-10-24 launch plan (docs/reviews/2026-10-24-launch-plan.md, step 1a). Umbrella: #41.

What

Make Cargo.toml publishable as-is and let cargo binstall injection-scanner resolve the existing release assets.

Measured today

• curl -A ua https://crates.io/api/v1/crates/injection-scanner → 404: the name is free. Crate name == [[bin]] name == #[command(name)] (src/main.rs:25), so no rename needed.
• cargo package --list --allow-dirty → 447 files; cargo package --allow-dirty --no-verify → 4.2 MiB, 1.3 MiB compressed. Under the 10 MB limit, but 212 of the 447 files are .planning/ (git-tracked), plus CLAUDE.md, 03-injection-scanner.md, claude-code-harness-engineering-guide-v2.md, tools/, integrations/, docs/superpowers/. None of that belongs in a crate.
• Present: description, license, repository, keywords (5), categories. Missing: readme, rust-version, exclude, [package.metadata.binstall].

How

readme = "README.md"
rust-version = "1.xx"   # whatever `cargo msrv` or CI's stable says
exclude = [".planning/", "docs/superpowers/", "tools/", "integrations/", ".github/",
           "CLAUDE.md", "TODO.md", "03-injection-scanner.md",
           "claude-code-harness-engineering-guide-v2.md"]

[package.metadata.binstall]
# Assets are RAW, unextensioned, target-triple-named (release contract; spec-ci-plugin depends on it).
pkg-url = "{ repo }/releases/download/v{ version }/{ name }-{ target }"
pkg-fmt = "bin"
bin-dir = "{ bin }{ binary-ext }"

Keep tests/ and tests/corpus/ in the crate (1.0 MB, see the decision in the plan) unless the owner decides otherwise.

Done when

• cargo package --list shows no .planning/ path and the file count is ~230 or lower.
• cargo publish --dry-run --locked succeeds.
• cargo binstall --dry-run --manifest-path Cargo.toml injection-scanner resolves the six asset URLs (after v0.3.0 exists on crates.io it must also work with no manifest).
• tests/release_contract_test.rs still passes (asset names unchanged).

Effort: ~1.5 h.