feat(ci): add deploy workflow for crates.io publishing

Add GitHub Actions workflow that triggers on v* tag pushes to
automatically publish the crate to crates.io using Trusted Publishers.

- Uses OIDC authentication (no API token required)
- Runs tests as a safety check before publishing
- Requires crates.io environment configuration

Co-Authored-By: Claude <noreply@anthropic.com>

Author: doitian

.github/workflows/deploy.yml

@@ -0,0 +1,25 @@
+name: Deploy
+
+on:
+  push:
+    tags: ['v*']
+
+jobs:
+  publish:
+    name: Publish to crates.io
+    runs-on: ubuntu-latest
+    environment: crates.io
+
+    permissions:
+      id-token: write
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+      - run: rustup update 1.76.0 && rustup default 1.76.0
+      - name: Run tests
+        run: cargo test --verbose
+        env:
+          RUSTFLAGS: "-Dwarnings"
+      - name: Publish
+        run: cargo publish

AGENTS.md

@@ -125,7 +125,8 @@ fiber-sphinx/
 │   └── CONTRIBUTING.md # Contribution guidelines
 └── .github/workflows/
     ├── ci.yml          # CI workflow (build, test, clippy)
-    └── cov.yml         # Coverage workflow
+    ├── cov.yml         # Coverage workflow
+    └── deploy.yml      # Deploy to crates.io on tag push
 ```
 
 ## CI Requirements
@@ -135,6 +136,21 @@ The CI runs on Rust 1.76.0, stable, beta, and nightly. All must pass:
 - `cargo test` - All tests pass
 - `cargo clippy` - No warnings (with `-Dwarnings`)
 
+## Releasing
+
+To publish a new version to crates.io:
+
+1. Update the version in `Cargo.toml`
+2. Commit the version bump
+3. Create and push a tag: `git tag v<version> && git push origin v<version>`
+4. The deploy workflow will automatically publish to crates.io
+
+**Setup:** Uses crates.io Trusted Publishers (no API token required). Configure the trusted
+publisher at https://crates.io/crates/fiber-sphinx/settings with:
+- Repository: `cryptape/fiber-sphinx`
+- Workflow: `deploy.yml`
+- Environment: `crates.io`
+
 ## Contributing Workflow
 
 1. Create branch from `develop`