crates.io packaging and publish job #35

Parent

#30

What to build

Make thirdshift publishable to crates.io and publish it on every release.

• The package manifest gains license and repository, plus an include list limited to the sources, the Factory skills (including their licence and credits files), the README and the LICENSE.
• .agents, .grok, .claude, docs and tests stay in the repository but out of the package.
• homepage stays unset until thirdshift.app is live.

Add a custom dist publish job that publishes the tagged version to crates.io with trusted publishing (GitHub OIDC, no stored token). The job skips publishing when the version is already on crates.io, because 0.1.0 will be published by hand first to claim the name, and so that re-running a release never fails. The job runs only after the platform smoke jobs pass.

Acceptance criteria

• cargo package succeeds and builds from its own contents.
• The package file list contains no .agents, .grok, .claude, docs or tests paths, and does contain the Factory skills with their licence and credits.
• The manifest has license and repository, and no homepage.
• A custom dist publish job publishes to crates.io with trusted publishing, and no crates.io token is referenced anywhere.
• The job skips an already-published version without failing.
• Publishing is gated on the Rocky and WSL smoke jobs.

Blocked by

• Release pipeline: binaries, installer and platform smoke tests #33 (release pipeline)