ci: publish to RubyGems via trusted publishing

[PhilMeyr]

Replaces the long-lived RUBYGEMS_API_KEY secret with OIDC trusted publishing.

• id-token: write + environment: release so the OIDC token carries the environment claim
• rubygems/configure-rubygems-credentials pinned to a SHA (upstream has no v1 tag)
• credentials are fetched after the build, since they expire 15 minutes later

Requires the trusted publisher to be declared on rubygems.org before merging. The RUBYGEMS_API_KEY secret can be deleted once a release has run green.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_3dbefd61-319a-4d8a-84a1-47255ea73153)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_f7c2e795-3467-4313-92f1-e5b51a1b7ac3)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_9b96bc0b-8307-45d6-b6cb-65a60046b944)