ci: add workflow for crate publishing

[conorsch]

Following up on the work to publish the workspace code to crates.io (#4978), we should add a CI workflow to automate that process. That work entails:

• updating the crates auth to gh groups
• generating a new CI token for use in CI
• writing a workflow that runs on tags, and executes ./deployments/scripts/publish-crates

Once that's handled, the crate publishing will happen automatically as part of our existing release process.

[conorsch]

Still not done; for v1.0.1 (#5021) I just published the crates manually using the script. They're live now: https://docs.rs/penumbra-sdk-app/1.0.1/penumbra_sdk_app/

[conorsch]

As part of the v1.0.2 release (which should have been 1.1.0), I ran the publishing script manually, and it worked great, no problems. Fine to include in CI for next release, IMO.

For the crate ownership, I've started sending invites via API to adjust the setup, will comment when that's complete.

[conorsch]

Not quite: the job failed with error:

Run nix develop --command ./deployments/scripts/publish-crates
  nix develop --command ./deployments/scripts/publish-crates
  shell: /usr/bin/bash -e {0}
  env:
    CARGO_REGISTRY_TOKEN: ***
    NIX_PROFILES: /nix/var/nix/profiles/default /home/runner/.nix-profile
    NIX_USER_PROFILE_DIR: /nix/var/nix/profiles/per-user/runner
    NIX_SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
    NIX_USER_CONF_FILES: /tmp/tmp.dVshnKGBfb/flake-nixConfig.conf:/home/runner/.config/nix/nix.conf:
    CACHE_ON_FAILURE: false
    CARGO_INCREMENTAL: 0
Publishing crate versions '1.1.0' to crates.io...
error: cannot release from branch "HEAD", instead switch to "*, !HEAD"

which is due to the way github checks out gitrefs in CI contexts: we're not simply using the "main" branch in that context, even though that's where the tag was made.

[conorsch]

Sick, looks like the latest version completed successfully in CI: https://github.com/penumbra-zone/penumbra/actions/runs/13687172377