refactor(xtask): use typed Cargo metadata

[ddurst-nvidia]

Pull Request

Adoption provenance

This upstream-owned PR adopts
source proposal #63 at exact
head 7da6b34a3e8e0e75d55ee64c7cf3395039456f40 without rewriting its
commits. The source proposal remains unchanged as review provenance.

Why

• Replace hand-maintained Cargo metadata JSON traversal in release-reachable
  xtask checks with Cargo's maintained typed metadata model.
• Keep process execution, output bounds, working directories, and repository
  release policy under the existing local controls.

What changed

• Add cargo_metadata with default features disabled and parse only bytes
  already captured by the bounded process runner.
• Centralize typed parsing and crates.io publication policy in one shared
  helper.
• Convert release package validation, release-policy detection, traits-source
  verification, and workspace version checks to typed Cargo metadata.
• Replace partial JSON test documents with complete Cargo-shaped fixtures,
  including registry and path package identities.

Review guide

• Start with xtask/src/cargo_metadata_output.rs, then review the typed policy
  use in release.rs, release_policy.rs, and versions.rs.
• MetadataCommand parses captured bytes only. It does not execute Cargo or
  bypass the existing bounded runner.

Compatibility impact

None. This changes internal xtask implementation only. Public Rust APIs,
package contents, workflow files, CLI arguments, and process bounds are
unchanged.

Release impact: no crate version advance is intended.

Dependency and licensing impact

• Adds exact cargo_metadata 0.23.1 with default features disabled. The new
  locked parser graph is limited to maintained Cargo model dependencies.
• The added crates use compatible permissive terms. Dependency audit passes.
• The dependency is confined to the unpublished xtask and does not change the
  published crate contents.

Related issue

None.

Testing

• Stable/current cargo xtask ci passed at the exact adopted head.
• The focused compatibility test suite passed at the same exact head.
• Both repository and xtask dependency audits passed.

Checklist

• I confirmed this belongs in the Rust implementation repository and is
  not a language-neutral specification change better handled in
  yaml-sigil-spec.
• I confirmed this change does not bypass or conflict with the public API
  contract in
  yaml-sigil-traits; no traits
  contract change is required.
• I have the right to submit this contribution, every commit is GitHub
  Verified, and every commit includes a Signed-off-by trailer that exactly
  matches its Git author.
• I understand and can explain this change.
• I updated documentation or tests where needed.
• I reviewed CONTRIBUTING.md and SECURITY.md.

[ddurst-nvidia]

/ok to test-and-adopt 7da6b34