fix(publish): retry cargo publish on transient registry index lag

[BryanFRD]

Releasing a multi-crate workspace to a private registry (kellnr) can fail when a dependent publishes before a just-published dependency lands in the sparse index — cargo errors with no matching package / required by package, which the publisher surfaced as a fatal E1018 (seen on FerrLabs/Kit 2026-06-24; recovered only via a manual re-run the next day).

The cargo publisher now retries cargo publish up to 3 times (5s then 15s backoff) on transient failures — sparse-index resolution lag and network blips (connection reset/refused, timeouts, 502/503/504) — while keeping the existing idempotent "already uploaded" → skip. A genuinely missing/misconfigured dependency still matches as transient but simply fails again after the retries are spent (slower failure, but the release survives index lag without a manual re-run). New unit test pins the transient classifier; cargo test, cargo clippy, cargo fmt all green locally.

Closes #621

[github-actions]

Benchmark

Details

Benchmark suite	Current: db2c85b	Previous: 0b5fe57	Ratio
validate/single	20046 ns/iter (± 206)
validate/mono_50	364918 ns/iter (± 6221)
validate/mono_100	716458 ns/iter (± 20134)

This comment was automatically generated by workflow using github-action-benchmark.