build(cli): publish to crates.io as ferrvault-cli

[BryanFRD]

Goal

`cargo install ferrvault-cli` works — source-compile fallback path for users who don't have `cargo-binstall` and want to avoid the curl-pipe script.

What to do

1. Reserve the `ferrvault-cli` crate name on crates.io.
2. Add a publish step to `cli-release.yml` (after upload-rust-binary), gated on `cli-v` tag push:

   - name: Publish to crates.io
     env:
       CARGO_REGISTRY_TOKEN: \${{ secrets.CRATES_IO_TOKEN }}
     working-directory: cli
     run: cargo publish

3. Add `CRATES_IO_TOKEN` as a repo secret (org-level via inheritance).

Caveats

• Crates.io publish is irreversible: a published version can be yanked but not deleted. So the publish job must only run on green tags, not on every push.
• The cli package today has the binary name `ferrvault` and package name `ferrvault-cli`. After install, the binary lands as `ferrvault` — that's what users expect.
• `cargo install ferrvault-cli` compiles the whole dep tree (~5 min cold). `cargo binstall` is the faster path; this one is the fallback.