wait for crates.io and fail on publish errors in release workflow

[fabracht]

The publish job ran each cargo publish with || echo "Version already published, skipping" and slept 30s between crates. A real publish failure was hidden, the job went green, and the GitHub Release was still created. And if crates.io had not listed the new mqtt5 within those 30s, the wasm and CLI publishes failed to resolve it and that failure was hidden too.

scripts/publish-crate.sh <package> now does each step:

• skips the crate only when the crates.io sparse index lists its version, so rerunning a failed release job is safe;
• treats only a 200 without the version, or a 404, as not published. Any other answer (5xx, 429, timeout, DNS) is retried every 10s, and the job fails after 10 minutes with the last status instead of publishing blind;
• otherwise runs cargo publish and lets a failure fail the job, which also stops the GitHub Release (create-release needs publish);
• then waits up to 10 minutes for the version to show up in the index before the next crate goes. cargo publish has its own 60s wait, but on timeout it only warns, and publish.timeout is still unstable.

Each index request has a 10s connect and 30s total timeout, and the version is matched as a fixed string.

Tested locally with stand-ins for cargo (cannot publish) and curl:

• the four crates at their released versions are skipped;
• a version that only matches with . as a regex wildcard is not treated as published;
• an unpublished version calls cargo publish, and a failed publish exits 1;
• a publish that never reaches the index exits 1 after the wait;
• an index that keeps returning 503, or a curl timeout, exits 1 without publishing;
• one 503 followed by a 200 skips the crate without publishing;
• an unknown package exits 1.

The real publish and wait-until-listed path only runs on the next tag.