[jedsalazar]

Summary

• Switches the release workflow from a static API token to crates.io's trusted publishing (OIDC-based, short-lived credentials scoped to this exact workflow)
• Updates the release-plz action to a version that supports the trusted-publishing exchange natively

Why

Replaces a long-lived secret with a short-lived credential minted per-run — nothing stored, nothing to rotate, nothing to leak.

Test plan

• Confirm the next release-plz run on main succeeds (publish or clean no-op)
• Confirm a real version publish goes through end-to-end
• Finish locking down the old publish path once the above are verified