[ci] Make crate releases resumable

[joshlf]

The old core workflow tagged before publishing, rejected any existing
tag on a retry, and serialized every version behind a workflow-wide
approval lock. It also compared only with HEAD^, so a multi-commit
push could silently miss a version bump.

Recent OIDC runs authenticated successfully but crates.io rejected
zerocopy-derive because trusted-publisher authorization is configured
per crate. Diagnose 403s with the exact owner, repository, workflow,
environment, and crate settings needed, and make retries reconcile
matching registry checksums rather than republishing blindly.

Package and verify release archives without credentials. Transfer only
the archive bytes, construct the release plan from trusted constants in
the privileged checkout, reproduce every archive byte-for-byte, and
publish dependencies in order without running package code. Scope the
Cargo and GitHub tokens to only their respective subprocesses.

Create or accept the exact GitHub tag and release only after all crates
are public. Accept completed matching state after a lost response,
reject yanked or mismatched crates, wrong tags, drafts, and release
metadata, and use version-specific concurrency so stale approvals cannot
block later versions.

Repair the Anneal publishability failure by giving its path dependency
an exact registry version and publishing exocrate first. The manually
published exocrate 0.2.0 and cargo-anneal alpha.24 were built from dirty
manifests that do not match repository source, so record that historical
exception and advance the incompatible checked-in exocrate API to 0.3.0.
Make packaged README assets absolute.

Run the exact release packaging boundaries in PR CI, and test the
cross-file workflow contracts and all reconciler failure/retry states.

---

• 　  [ci] Consolidate build and test passes #3506
• 　  [ci] Parallelize Miri and harden feature coverage #3505
• 　  [ci] Keep read-only checks from rewriting lockfiles #3516
• 👉 [ci] Make crate releases resumable #3515
• 　  [ci] Fail required gates closed on cancellations #3514
• 　  [ci] Separate testing from privileged publication #3513

Latest Update: v7 — Compare vs v6

📚 Full Patch History

Links show the diff between the row version and the column version.

Version	v6	v5	v4	v3	v2	v1	Base
v7	vs v6	vs v5	vs v4	vs v3	vs v2	vs v1	vs Base
v6		vs v5	vs v4	vs v3	vs v2	vs v1	vs Base
v5			vs v4	vs v3	vs v2	vs v1	vs Base
v4				vs v3	vs v2	vs v1	vs Base
v3					vs v2	vs v1	vs Base
v2						vs v1	vs Base
v1							vs Base

⬇️ Download this PR

Branch

git fetch origin refs/heads/Gr5dxmcwfct6ij22jsf3sevpdetlzlcuz && git checkout -b pr-Gr5dxmcwfct6ij22jsf3sevpdetlzlcuz FETCH_HEAD

Checkout

git fetch origin refs/heads/Gr5dxmcwfct6ij22jsf3sevpdetlzlcuz && git checkout FETCH_HEAD

Cherry Pick

git fetch origin refs/heads/Gr5dxmcwfct6ij22jsf3sevpdetlzlcuz && git cherry-pick FETCH_HEAD

Pull

git pull origin refs/heads/Gr5dxmcwfct6ij22jsf3sevpdetlzlcuz

Stacked PRs enabled by GHerrit.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (G25sqrb3x2qf3c2e26jcymmrjhitfoijb@1d9867a). Learn more about missing BASE report.

Additional details and impacted files

@@                         Coverage Diff                          @@
##             G25sqrb3x2qf3c2e26jcymmrjhitfoijb    #3515   +/-   ##
====================================================================
  Coverage                                     ?   91.85%           
====================================================================
  Files                                        ?       20           
  Lines                                        ?     6093           
  Branches                                     ?        0           
====================================================================
  Hits                                         ?     5597           
  Misses                                       ?      496           
  Partials                                     ?        0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.