ci: add OIDC trusted publishing release workflow

Uses crates.io trusted publishing via GitHub Actions OIDC so no
long-lived CARGO_REGISTRY_TOKEN secret is needed. Triggers on
version tags (v*).

https://claude.ai/code/session_01TCLsdwZEbxsMdnqGaG7rbp

Author: claude

.github/workflows/release.yml

@@ -0,0 +1,26 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v[0-9]+.*"
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required for OIDC trusted publishing
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Obtain crates.io token via OIDC
+        uses: rust-lang/crates-io-cargo-trusted-publishing@v0
+
+      - name: Publish
+        run: cargo publish