ci: automate releases with release-plz

[merlimat]

What (roadmap P5-7)

Automates releases with release-plz, replacing the manual release-cargo.yml (removed).

On every push to main, the new Release-plz workflow:

1. keeps a release PR open that bumps oxia-client's version from the Conventional Commits merged since the last release;
2. on merge of that PR, cargo publishes oxia-client, pushes a vX.Y.Z tag, and creates a GitHub Release with notes generated from the commit history.

Fits this repo's conventions (release-plz.toml)

• No in-repo changelog — changelog_update = false, so no CHANGELOG.md is ever written; release notes live in the GitHub Release (matching the earlier decision).
• Only oxia-client is released — the FFI shim and oxia-perf are internal (publish = false + release = false); release-plz never publishes/tags them (it may bump the FFI version in lockstep).
• semver_check = false — ci.yml already runs cargo-semver-checks against the published baseline; not duplicated here.

Verification

Ran release-plz update against the repo (in a plain clone) — it loaded the config and computed oxia-client: 0.1.0 → 0.1.1 and wrote no CHANGELOG.md (only Cargo.toml/Cargo.lock version bumps). Config TOML + workflow YAML validated. The full publish/GitHub-Release path only runs on GitHub, so the first release is the end-to-end confirmation.

⚠️ One-time setup needed (maintainer)

Documented in RELEASING.md:

• CRATE_TOKEN secret (already set for 0.1.0) is reused as CARGO_REGISTRY_TOKEN — needs publish-update scope for oxia-client.
• Enable Settings → Actions → General → Workflow permissions → "Allow GitHub Actions to create and approve pull requests" so the release PR can be opened.
• Optional: to have CI run on the release PR, supply a PAT/GitHub-App token as the release-pr job's GITHUB_TOKEN (PRs opened by the default GITHUB_TOKEN don't trigger other workflows).