ci(release): publish to crates.io via trusted publishing

Add a publish-rust job mirroring cooklang-rs: OIDC auth through
rust-lang/crates-io-auth-action, then `cargo publish --no-verify`.
It depends on create-release rather than the build jobs — a crates.io
publish can only be yanked, never redone, so it should not run unless
the tag and GitHub release actually landed.

Also adopt two cooklang-rs conventions: a dry_run input gating all
three publish/release jobs, and prerelease derived from alpha/beta/rc
in the version string instead of hardcoded false.

Requires one-time setup on crates.io: Trusted Publishing for
cooklang/cooklang-import with workflow filename release.yml.

Author: dubadub

.github/workflows/release.yml

@@ -7,6 +7,11 @@ on:
         description: 'Release version (e.g., 0.8.16)'
         required: true
         type: string
+      dry_run:
+        description: 'Dry run (skip release creation and publishing)'
+        required: false
+        default: false
+        type: boolean
 
 env:
   CARGO_TERM_COLOR: always
@@ -351,6 +356,7 @@ jobs:
     name: Create Tags and Release
     needs: [prepare-release, build-ios, build-android, update-package-swift]
     runs-on: ubuntu-latest
+    if: ${{ github.event.inputs.dry_run != 'true' }}
     permissions:
       contents: write
     steps:
@@ -391,7 +397,7 @@ jobs:
           tag_name: ${{ needs.prepare-release.outputs.version_tag }}
           name: Release ${{ needs.prepare-release.outputs.version_tag }}
           draft: false
-          prerelease: false
+          prerelease: ${{ contains(github.event.inputs.version, 'alpha') || contains(github.event.inputs.version, 'beta') || contains(github.event.inputs.version, 'rc') }}
           generate_release_notes: true
           files: |
             CooklangImportFFI.xcframework.zip
@@ -456,6 +462,7 @@ jobs:
     name: Publish Android to GitHub Packages
     needs: [prepare-release, build-android, create-release]
     runs-on: ubuntu-latest
+    if: ${{ github.event.inputs.dry_run != 'true' }}
     permissions:
       contents: read
       packages: write
@@ -631,3 +638,30 @@ jobs:
         run: |
           gradle wrapper --gradle-version 8.5
           ./gradlew publish --no-daemon
+
+  # Publish Rust crate to crates.io
+  publish-rust:
+    name: Publish to crates.io
+    needs: [prepare-release, create-release]
+    runs-on: ubuntu-latest
+    if: ${{ github.event.inputs.dry_run != 'true' }}
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v4
+        with:
+          ref: main
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Authenticate to crates.io
+        uses: rust-lang/crates-io-auth-action@v1
+        id: auth
+
+      - name: Publish to crates.io
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
+        run: cargo publish --no-verify