fix(release): publish crates.io releases via trusted GitHub Actions flow

[mstykow]

Summary

• move crates.io publish from local cargo-release execution into the tag-triggered GitHub Actions release workflow
• add release verification gates for version sync, tag/version alignment, origin/main reachability, crate size, and publish dry-run packaging
• document the two-phase maintainer release flow and the trusted publishing setup for provenant-cli

Issues

• Covers: release automation hardening and trusted publishing migration

Scope and exclusions

• Included: workflow/job wiring, cargo-release config updates, release script changes, new tag sync helper, and maintainer documentation updates
• Explicit exclusions: no runtime scanner behavior changes, no parser changes, no expected-output fixture updates

Follow-up work

• Created or intentionally deferred: validate the GitHub crates-io environment reviewers and crates.io trusted publisher settings before the first tagged release using this flow

Expected-output fixture changes

• Files changed: none
• Why the new expected output is correct: no golden or expected-output fixtures changed in this branch