crates.io publishing: rename published crates to kilnvm-* + add synth-modeled publish workflow

[avrabe]

Goal

Publish the kiln workspace to crates.io (currently kiln cuts only signed GitHub releases — no cargo publish anywhere in CI). Two coupled pieces: a rename to clear name conflicts, and a publish workflow modeled on synth.

Why a rename (verified on crates.io, 2026-06-14)

The bare kiln-* namespace is contested by other owners, so we can't publish as-is:

• kiln-runtime → owned by zenvanexus (v0.1.1)
• also taken by others: kiln-core, kiln-cli, kiln-cache, kiln-exec, the kiln-sv-* SystemVerilog family, and kiln itself (v0.0.0 squat)
• 20 of our 21 publishable names are free, but renaming only the one conflict would be inconsistent.

Decision: publish under the kilnvm-* prefix (creative + consistent; "kiln VM"). Verified fully available on crates.io (every target name 404), and kilnvm itself is free as an umbrella crate. The git repo, tags, directory names, and the cargo-kiln CLI stay "kiln" — only the published [package] name changes.

Rename map (published name only; dirs stay kiln-*)

kiln-runtime → kilnvm-runtime, kiln-foundation → kilnvm-foundation, kiln-error → kilnvm-error, kiln-decoder → kilnvm-decoder, kiln-component → kilnvm-component, kiln-async → kilnvm-async, kiln-wasi → kilnvm-wasi, kiln-sync → kilnvm-sync, kiln-host → kilnvm-host, kiln-intercept → kilnvm-intercept, kiln-instructions → kilnvm-instructions, kiln-platform → kilnvm-platform, kiln-builtins → kilnvm-builtins, kiln-build-core → kilnvm-build-core, kiln-debug → kilnvm-debug, kiln-format → kilnvm-format, kiln-logging → kilnvm-logging, kiln-math → kilnvm-math, kiln-panic → kilnvm-panic, kilnd → kilnvmd. (cargo-kiln unchanged.)

Publish workflow (model: synth/.github/workflows/publish-to-crates-io.yml)

• Trigger on v* tag push (parallel to release.yml) + workflow_dispatch.
• Auth via org-wide CRATES_IO_TOKEN secret (inherited from the pulseengine org), read as CARGO_REGISTRY_TOKEN.
• Preflight: assert the tag matches the workspace version.
• A scripts/publish.rs helper that walks crates in dependency order with a retry loop (~10×, 40s) to ride out crates.io index propagation between dependent crates (synth's note: no --dry-run/cargo package preflight — it hits a chicken-and-egg on first publish of a new version since path-dep version reqs resolve against the index).

Acceptance

• Decide final prefix (kilnvm-, confirmed).
• Rename PR: [package] name + all internal dep refs → kilnvm-*; workspace builds, tests green, rivet validate 0 errors.
• publish-to-crates-io.yml + scripts/publish.rs added (synth-modeled).
• Org CRATES_IO_TOKEN confirmed available to this repo.
• First publish on the next v* tag; verify all crates land on crates.io in dep order.

Scope / timing

Next-release item (not v0.3.2 — that ships as a GitHub signed release). Tracked in rivet (REQ_CRATES_PUBLISH, design-decision for the kilnvm naming).