feat(releases): add Cargo crate evidence profile

[szmyty]

Closes #50.

What this adds

• a versioned cargo-crate release profile for Cargo package distribution
• a strict egohygiene.relay-cargo-crate-release/v1 evidence contract
• exact <package>-<version>.crate archive and SHA-256 agreement
• Cargo.toml-owned version authority, including independently versioned workspace packages
• required provenance, SPDX SBOM, signature, and checksum evidence
• explicit external/unavailable registry state without implying crates.io publication
• fail-closed validation for missing, extra, renamed, unsafe, or digest-drifted archives
• yank-and-replacement rollback guidance
• profile/schema/action documentation and regression coverage

Compiled Rust binaries intentionally remain under Relay's distinct binary profile. A project shipping both a crate and executables composes two independently reviewable bundles.

Validation

• complete Python suite: 170 tests passed
• action/catalog validation: 6 actions, 8 workflows, 4 reusable workflows
• Python compilation
• all 34 JSON documents parsed
• whitespace validation

Ruby is unavailable in the local workspace, so the repository's required CI gate remains responsible for parsing GitHub Actions YAML.

After this merges, the next dependency-correct task is #47: reusable semantic-release workflows.

[devactivity-app]

Pull Request Summary by devActivity

Metrics

Achievements

• @szmyty
  Earned XP: 10⭐
  Check Your Progress