Publish Rust release notes before creating immutable crate artifacts

[rmcdaniel]

Problem

The crates.io artifact for durable-workflow 2.0.0-rc.31 records VCS commit 4d6e7405487e770dba0690f5d0a65a4e1631c26f and contains the Avro task-boundary fix, but its embedded CHANGELOG.md does not contain the Avro-boundary note that target-branch commit 8fbc2923cdebd7527f02875ad0ee4ca096dc4d14 later added to the rc.31 section. Because registry artifacts are immutable, package consumers and repository readers now see different release histories for the same version.

Acceptance criteria

• Compose and land the complete current-version release-note entry before cargo publish, tagging, or generated-reference deployment authorizes that version.
• Before the irreversible publish step, inspect the package produced by cargo package and prove that its current-version changelog entry is present and that its VCS metadata identifies the commit containing that entry. Keep the check structural rather than coupling it to exact prose or Markdown layout.
• Verify the downloaded registry artifact after publication and fail the release workflow if its checksum or VCS identity differs from the authorized package.
• Preserve the immutable rc.31 artifact; carry the corrected history forward in the next sequential prerelease instead of attempting to reuse the version.

Delete when

Delete when a later sequential prerelease contains the complete target-branch changelog state in its downloaded crate archive and the release workflow prevents release-note commits from landing only after publication.