feat(release): publish reusable library crates to crates.io

[avrabe]

Summary

Makes scry's reusable work body publishable to crates.io, mirroring pulseengine/synth (itself modelled on pulseengine/sigil). Publishes the pure library crates; the Wasm-component crates continue to ship as signed .wasm release assets — the witness precedent (publish the libraries, ship the component).

Published set (leaf-first)

scry-interval, scry-taint, scry-octagon, scry-provenance → scry-analyze-core.

These are the genuinely reusable APIs (pure #![no_std] libraries). Internal path deps now carry version = "1.9.0" so cargo publish rewrites them to the crates.io coordinate (crates.io rejects path-only deps). The scry-* names are free on crates.io.

Not published (publish = false)

• wasm-lattice, scry-analyzer — cdylib Wasm components whose WIT bindings are generated by the Bazel rust_wasm_component_bindgen rule (no cargo source) and which only build for wasm32-wasip2. A host cargo publish cannot build them, and a cargo add consumer cannot use a cdylib component. Making them publishable would require switching to wit_bindgen::generate! + replacing the Bazel rule and re-validating the //:scry composition — moderate risk to the shipped product, and witness deliberately does not publish its component crate either. They ship as signed .wasm assets (already done in release.yml).
• scry-host-tests, scry-mcdc — test / MC-DC harnesses (already unpublished).

Mechanism

• .github/workflows/publish-to-crates-io.yml — fires on every v* tag alongside release.yml; asserts tag == workspace version; runs the helper with the org-wide CRATES_IO_TOKEN.
• scripts/publish.rs — leaf-first dependency-ordered publisher with a 10-attempt / 40s retry loop for crates.io index propagation + an already-published skip check.

Version alignment

workspace.package.version 0.1.0 → 1.9.0, aligning the crate version with the v1.x release-tag line / SCRY_VERSION (your call). A future release bump moves the tag, this version, and the path-dep version fields in lockstep. The first crates.io publish lands on the next release tag (v1.9.0 already exists, pointing at the pre-bump commit).

Verification

• cargo package succeeds for all 4 leaf crates at 1.9.0.
• scripts/publish.rs compiles (rustc --edition 2024).
• scry-analyze-core builds; scry-mcdc (separate workspace) builds against analyze-core@1.9.0; fmt / clippy / rivet validate clean.
• (scry-analyze-core can't be cargo packaged locally — the chicken-and-egg where its path-dep versions aren't on the registry yet; this is expected and why CI uses publish, not --dry-run.)

Note on auth

Assumes the org-wide CRATES_IO_TOKEN secret is inherited by this repo (as in synth). No publish happens until a v* tag fires the workflow.

🤖 Generated with Claude Code