ci: Drop cargo-release from publish workflow, verify tag is on main

cargo-release adds no value over cargo publish when the version is
already bumped and tagged. Removing it also removes the detached-HEAD
allow-branch awkwardness. Safety is enforced by an explicit check
that the release tag's commit is reachable from origin/main.

Author: claude

.github/workflows/release.yml

@@ -13,12 +13,15 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: taiki-e/install-action@v2
         with:
-          tool: cargo-release
+          fetch-depth: 0
+      - name: Verify release tag is on main
+        run: |
+          git fetch origin main --depth=1
+          git merge-base --is-ancestor "$GITHUB_SHA" origin/main
+      - uses: dtolnay/rust-toolchain@stable
       - uses: rust-lang/crates-io-auth-action@v1
         id: auth
-      - run: cargo release publish --execute --no-confirm --allow-branch '*'
+      - run: cargo publish
         env:
           CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}