[gobby-cli-#962] ci: publish gwiki via CARGO_REGISTRY_TOKEN, not Trusted Publishing

release-gwiki.yml's publish job used GitHub OIDC Trusted Publishing
(rust-lang/crates-io-auth-action + id-token: write + environment: crates-io),
but crates.io has no Trusted Publishing config registered for gobby-wiki, and
that config can only be created in the crates.io web UI, not via the CLI — so
the gwiki-v0.6.5 publish failed with "No Trusted Publishing config found for
repository GobbyAI/gobby-cli".

Switch gwiki to the same static CARGO_REGISTRY_TOKEN secret that already ships
gobby-core, gcode, and ghook to the registry. Drop the OIDC auth step, the
id-token permission, and the crates-io environment. Update the release guide
accordingly.

Validated with actionlint.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: joshwilhelmi

.github/workflows/release-gwiki.yml

@@ -326,8 +326,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      id-token: write # Required for crates.io trusted publishing via GitHub OIDC.
-    environment: crates-io
 
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
@@ -355,7 +353,7 @@ jobs:
             echo "gobby-wiki ${version} not on crates.io (HTTP 404); will publish."
             echo "skip=false" >> "$GITHUB_OUTPUT"
           elif [ "$code" = "403" ]; then
-            echo "::error::crates.io denied version check for gobby-wiki ${version}: HTTP 403 (curl exit ${curl_status}). Verify registry access and trusted publishing permissions." >&2
+            echo "::error::crates.io denied version check for gobby-wiki ${version}: HTTP 403 (curl exit ${curl_status}). Verify registry access." >&2
             exit 1
           elif [ "$curl_status" -ne 0 ]; then
             echo "::error::crates.io version check failed (curl exit ${curl_status}, HTTP ${code:-unknown})." >&2
@@ -365,16 +363,11 @@ jobs:
             exit 1
           fi
 
-      - name: Authenticate to crates.io
-        id: auth
-        if: steps.published.outputs.skip != 'true'
-        uses: rust-lang/crates-io-auth-action@bbd81622f20ce9e2dd9622e3218b975523e45bbe
-
       - name: Publish gobby-wiki to crates.io
         if: steps.published.outputs.skip != 'true'
         env:
-          CRATES_IO_TOKEN: ${{ steps.auth.outputs.token }}
-        run: cargo publish -p gobby-wiki --locked --token "$CRATES_IO_TOKEN"
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        run: cargo publish -p gobby-wiki --locked
 
   release:
     needs: [build, publish]

docs/guides/release-guide.md

@@ -57,9 +57,11 @@ fires no event.
 The release workflows verify binary crate tag/version alignment where the
 installer expects GitHub assets. `gobby-core` has no binary artifact matrix.
 
-The `gwiki` crates.io publish uses Trusted Publishing in the GitHub environment
-`crates-io`. The workflow obtains an OIDC token during the publish job, so no
-crates.io API token secret is needed for that release.
+All four crates publish to crates.io with the repository `CARGO_REGISTRY_TOKEN`
+secret via `cargo publish` (which reads the token from the environment). `gwiki`
+previously used GitHub OIDC Trusted Publishing, but that path needs a
+crates.io-side config that cannot be registered from the CLI, so its publish job
+now matches `gcode`/`ghook`/`gobby-core`.
 
 ## Local Install Check