fix(release): publish to crates.io and trigger release after auto-tag

[Obsecurus]

Summary

• add publish-crates job to release.yml using secrets.CARGO_REGISTRY_TOKEN
• add crates.io publication verification loop in release workflow
• add workflow_dispatch input (version) to release.yml for deterministic reruns
• ensure all release jobs checkout the version ref being released
• update auto-tag-release.yml to trigger release.yml after pushing the tag

Why

Tag creation via workflow did not consistently result in an observable release pipeline run, and release workflow did not publish to crates.io.

Validation

• cargo test --workspace --no-run