ci: use Trusted Publishing for crates.io

[funcpp]

Summary

crates.io added OIDC Trusted Publishing for GitHub Actions in July 2025 (rust-lang RFC 3691, blog post). Switch the publish-crates job to use it instead of a long-lived CARGO_REGISTRY_TOKEN secret.

Benefits:

• No long-lived token in repo secrets — workflow exchanges a GitHub-issued OIDC token for a 30-minute crates.io access token at publish time.
• Matches the publish-pypi job, which already uses PyPI's OIDC Trusted Publishing.
• Token can't be reused outside this exact workflow + environment + repo combination, so leakage from log lines or runner compromise is far less damaging.

One-time setup before tagging v0.2.0

On crates.io: go to sqllineage crate → Settings → Trusted Publishing → add a GitHub publisher with:

• Repository owner: funcpp
• Repository name: sqllineage
• Workflow filename: release.yml
• Environment name: crates-io

The environment name must match environment: crates-io in the workflow. The crates-io GitHub Environment doesn't strictly need to exist yet — but creating it lets you add reviewer / branch protection rules around the publish step.

Test plan

• git diff — only release.yml changed; 9 inserted, 1 removed.
• After merge: register the Trusted Publisher on crates.io with the values above.
• After tagging v0.2.0: confirm the publish-crates job acquires a token via the auth action and cargo publish succeeds.

🤖 Generated with Claude Code