Harden crates.io release publishing

[pproenca]

Motivation

• Prevent the release workflow from silently trusting and skipping internal crate names/versions that already exist on crates.io, which opens a dependency-confusion supply-chain risk.
• Ensure publishing only proceeds when the exact target versions for all internal crates are confirmed to be absent from the public registry.

Description

• Add a preflight in the GitHub Actions publish-crates step that checks every release crate/version and aborts the job with an error if any target version already exists on crates.io instead of continuing and skipping those crates.
• Preserve the dependency-order cargo publish pass which runs only after the preflight confirms no preexisting crate versions.
• Update the xtask release-workflow test release_workflow_publishes_and_smokes_crates_io_and_source_install to assert the presence of the new preexisting-crate guard strings in .github/workflows/release.yml.

Testing

• Ran cargo test -p xtask release_workflow_publishes_and_smokes_crates_io_and_source_install and it passed.
• Ran cargo test -p xtask crates_io_publish_plan_accepts_runtime_crate_graph and it passed.
• Ran cargo fmt --check and git diff --check which both succeeded.

---

Codex Task

[8090-software-factory]

⚠️ Drift Bot (agent-tui): 1 potential drift finding(s)

1. Blueprint: Installation and Distribution

File: .github/workflows/release.yml:601

The blueprint specifies that the ReleasePackager is responsible for building and assembling release artifacts, but it does not document the safety requirement that the release workflow must abort if target crate versions already exist on crates.io to prevent dependency confusion.

[8090-software-factory]

⚠️ Drift Bot (agent-tui) — Blueprint: Installation and Distribution

The blueprint specifies that the ReleasePackager is responsible for building and assembling release artifacts, but it does not document the safety requirement that the release workflow must abort if target crate versions already exist on crates.io to prevent dependency confusion.