Summary

• add a manually dispatched crate publication workflow pinned to an exact commit SHA
• verify SemVer, source commit, Cargo metadata, formatting, tests, and cargo publish --dry-run before upload
• use a crates.io-compliant project User-Agent and wait for registry visibility
• create an idempotent GitHub Release at the published source commit

Motivation

A3S Box v3.1.0 depends on a3s-runtime at commit 91a1b4c67ef2691915f2409a8cf835f7534020ff. Publishing that exact 0.2.0 crate is required before the Box runtime and SDK crates can be published.

Validation

• workflow YAML parsed locally
• all embedded Bash blocks pass bash -n
• cargo publish --locked --dry-run passes at the exact release commit