ci: publish crates.io through OIDC

[mstuart]

Summary

• replace the long-lived CARGO_REGISTRY_TOKEN secret with a short-lived crates.io OIDC token
• grant id-token: write and use the official auth action pinned to v1.0.4 commit bbd81622f20ce9e2dd9622e3218b975523e45bbe
• preserve the existing seven-crate publish order and waits
• pin the other external actions in crates-io.yml to the exact commits behind their existing refs

crates.io prerequisites

Configure a trusted publisher separately for each crate:

• tare-tokenize
• tare-cache
• tare-core
• tare-memory
• tare-cli
• tare-proxy
• tare-mcp

Use these exact values for every crate:

• GitHub organization/user: mstuart
• repository: tare
• workflow filename: crates-io.yml
• environment: none (leave blank)

All seven publisher records must exist before this workflow can complete. This PR does not configure crates.io or publish a release.

Verification

• actionlint 1.7.12
• immutable action-ref and focused crates.io OIDC/order checks
• cargo fmt and clippy
• full workspace tests and release build
• cargo package --list for all seven publishable crates