refactor(xtask): use typed Cargo metadata

[ddurst-nvidia]

Pull Request

Why

• Replace hand-maintained Cargo metadata JSON traversal in release-reachable
  xtask checks with Cargo's maintained typed metadata model.
• Keep process execution, output bounds, working directories, and repository
  release policy under the existing local controls.

What changed

• Add cargo_metadata with default features disabled and parse only bytes
  already captured by the bounded process runner.
• Centralize typed parsing and crates.io publication policy in one shared
  helper.
• Convert release package validation, release-policy detection, traits-source
  verification, and workspace version checks to typed Cargo metadata.
• Replace partial JSON test documents with complete Cargo-shaped fixtures,
  including registry and path package identities.

Review guide

• Start with xtask/src/cargo_metadata_output.rs, then review the typed
  policy use in release.rs, release_policy.rs, and versions.rs.
• The key invariant is that MetadataCommand parses captured bytes only; it
  does not execute Cargo or bypass the existing bounded runner.

Compatibility impact

None. This changes internal xtask implementation only. Public Rust APIs,
package contents, workflow files, CLI arguments, process bounds, and MSRV are
unchanged.

Release impact: no crate version advance is intended.

Dependency and licensing impact

• Adds cargo_metadata 0.23.1 with default features disabled. The new locked
  parser graph is limited to maintained Cargo model dependencies such as
  camino and cargo-platform.
• The added crates use MIT and/or Apache-2.0 terms. Dependency audit and policy
  checks pass.
• The dependency is confined to the unpublished xtask and does not change
  published crate contents.

Related issue

None.

Testing

• cargo +1.95.0 xtask ci — passed.
• cargo +1.95.0 fmt --manifest-path xtask/Cargo.toml --all --check — passed.
• cargo +1.95.0 clippy --manifest-path xtask/Cargo.toml --locked --offline --all-targets -- -D warnings — passed.
• cargo +1.95.0 test --manifest-path xtask/Cargo.toml --locked --offline — 133 passed, 7 intentionally ignored.
• cargo +1.95.0 xtask release check-packages yaml-sigil-core yaml-sigil-transcription yaml-sigil-signing yaml-sigil-verification — passed.
• cargo +1.95.0 xtask release-version check — passed.
• cargo +1.95.0 xtask sync-workspace-versions --check — passed.
• cargo audit --file xtask/Cargo.lock — passed.

Checklist

• I confirmed this belongs in the Rust implementation repository and is
  not a language-neutral specification change better handled in
  yaml-sigil-spec.
• I confirmed this change does not bypass or conflict with the public API
  contract in
  yaml-sigil-traits; no traits
  contract change is required.
• I have the right to submit this contribution, every commit is GitHub
  Verified, and every commit includes a Signed-off-by trailer that exactly
  matches its Git author.
• I understand and can explain this change.
• I updated documentation or tests where needed.
• I reviewed CONTRIBUTING.md and SECURITY.md.

[ddurst-nvidia]

Superseded by upstream-owned PR #64, which merged this exact reviewed tree to main as f031bbb. Closing this original fork proposal while preserving it as adoption provenance.