feat: tag commit and create GitHub release in manual publish workflow

[Pijukatel]

Summary

Brings the Rust client's manual release workflow into compliance with the Publishing requirement that the manual release workflow also creates a tagged GitHub release. Previously rust-publish.yml only published to crates.io; it now also tags the released commit and creates a matching GitHub release, mirroring the Go client's go-publish.yml.

The OpenAPI spec is already on v2-2026-06-18T095846Z, so there are no endpoint/spec/test changes — this is a workflow + docs change only.

Changes

• .github/workflows/rust-publish.yml — the manual (workflow_dispatch) publish workflow now:
  • Adds permissions: contents: write, full-history checkout (fetch-depth: 0), and a hard "Require master branch" guard.
  • Resolves the version from the single source of truth (Cargo.toml version, the same value CLIENT_VERSION reads via CARGO_PKG_VERSION), validates it as bare semver, and guards against an already-existing tag (local + remote).
  • Pushes the tag and creates the GitHub release before cargo publish (the only unrepeatable step); the release step is idempotent.
  • Extracts release notes from the matching ## [X.Y.Z] CHANGELOG section, with a fallback.
  • dry_run now also skips tag/release creation. Secrets are read only from repository secrets (CARGO_REGISTRY_TOKEN; tag/release use the default GITHUB_TOKEN).
• Cargo.toml — version bump 0.2.2 → 0.2.3.
• CHANGELOG.md — new [0.2.3] entry.
• README.md — "Releasing" section rewritten with prerequisites, numbered steps, master-gate / tag-guard / missing-token behavior, and a "Recovering from a failed release" subsection.

Testing

• cargo test --all passes (unit, integration with APIFY_TOKEN, and 22 doctests; all 0 failed).
• cargo fmt --check and cargo clippy -D warnings clean.
• Publish workflow YAML validated.

---

Generated by Claude Code