feat: automate crate and binary releases

[lucarlig]

Summary

• publish all five workspace crates to crates.io from pushes to main with release-plz
• create an atomic GitHub release with attested, checksummed native binaries for Linux, macOS, and Windows
• configure cargo-binstall to use only first-party release archives and never fall back to local compilation

Verification

• cargo fmt --all --check
• actionlint .github/workflows/release.yml
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-targets
• cargo package --workspace --allow-dirty --no-verify
• cargo build --release --locked --bin cf-integration
• release archive contents and binary help smoke test

Required repository setup

Before merging, add the Actions secret CARGO_REGISTRY_TOKEN with permission to publish the five new crates. Also ensure Actions is allowed to create pull requests so release-plz can maintain release PRs.

Stacked on #4.