ci: add release-plz and cargo-semver-checks

[jdx]

Summary

• Add release-plz workflow for automated release PRs and crates.io publishing
• Add cargo-semver-checks CI job to catch accidental breaking API changes

Test plan

• Verify CARGO_REGISTRY_TOKEN secret is configured in the repo
• Merge and confirm release-plz creates a release PR on next push to main
• Verify semver-checks job runs on PRs

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes CI/CD behavior by enabling automated releases and crates.io publishing, which can impact release cadence and publication if misconfigured; otherwise the change is isolated to GitHub Actions workflows.

Overview
Introduces a new GitHub Actions workflow, release-plz.yml, that runs on pushes to main to automatically open release PRs and perform releases/publishing via release-plz (using CARGO_REGISTRY_TOKEN).

Extends the existing test.yml workflow with a semver-checks job that runs cargo-semver-checks in CI to catch accidental breaking public API changes alongside existing tests and security audit.

^{Written by Cursor Bugbot for commit eacb0e5. This will update automatically on new commits. Configure here.}

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.