Fix publish-docker permissions; harden release-bump no-op detection

The first attempt at v0.1.0 failed at workflow startup because
publish-docker.yml declared `contents: read` and `attestations: write`
at the workflow level — permissions that the calling job
(custom-publish-docker in release.yml, generated by cargo-dist) doesn't
grant. GitHub rejects reusable workflows that try to widen permissions
beyond what the caller grants.

Trim publish-docker.yml's top-level permissions to just `packages: write`
and `id-token: write`, matching what cargo-dist gives the custom job.
We never call actions/attest in this workflow (the SLSA attestations are
already attached upstream by the build-local-artifacts job), so dropping
`attestations: write` doesn't cost us anything. `contents: read` is
inherited from the caller's workflow-level `contents: write`.

Also harden `release-bump`: if Cargo.toml is already at the requested
version (true for the first release where the scaffold lands at the
intended version), exit cleanly with a hint pointing at release-tag-main,
instead of creating an empty branch and a doomed PR. Triggered by the
exact path we hit on the first v0.1.0 attempt.

Author: johnpmitsch

.github/workflows/publish-docker.yml

@@ -16,11 +16,14 @@ on:
         required: true
         type: string
 
+# Permissions must NOT exceed what the caller (release.yml's
+# `custom-publish-docker` job) grants — reusable workflows can't widen
+# permissions. cargo-dist gives custom publish jobs id-token + packages
+# write, plus the workflow-level contents: write inherited via the
+# caller. That's enough for GHCR push and gh release download.
 permissions:
-  contents: read
   packages: write
   id-token: write
-  attestations: write
 
 env:
   REGISTRY: ghcr.io

Justfile

@@ -67,6 +67,11 @@ release-bump version:
     echo "Error: working tree is not clean. Commit or stash changes before bumping." >&2
     exit 1
   fi
+  current_version=$(sed -nE 's/^version = "(.+)"/\1/p' Cargo.toml | head -1)
+  if [[ "$current_version" == "{{version}}" ]]; then
+    echo "Cargo.toml is already at {{version}}. No bump needed — skip to: just release-tag-main {{version}}" >&2
+    exit 0
+  fi
   git checkout -b "release/v{{version}}"
   sed -i.bak 's/^version = ".*"/version = "{{version}}"/' Cargo.toml && rm Cargo.toml.bak
   # Refresh Cargo.lock so it matches the new version.