fix(release): restore crates.io trusted publishing

[tcballard]

Why

The v0.28.0 native release produced its archives, images, attestations, SBOM, and MCP Registry record, but the crates.io stage failed during OIDC authentication. crates.io expected crates-publish.yml; the reusable call caused the JWT to identify native-publish.yml instead.

Failed run: https://github.com/asdecided/core/actions/runs/31315712199

What changed

• Run crates-publish.yml as a top-level workflow_run only after a successful release-triggered native publication.
• Require the upstream run to come from this repository.
• Keep the existing manual dispatch recovery path.
• Remove the reusable crates.io call from native-publish.yml.

This preserves the release ordering while making the OIDC workflow filename match all three crates.io trusted-publisher records.

Verification

• Both workflow files parse as YAML.
• The commit changes only the two release workflow files.
• The crates publisher remains idempotent for already-published versions.
• No tag, release, crate, image, registry record, or website deployment is created by this PR.