ci(deploy): trusted publishing (#423)

Co-authored-by: Claude <noreply@anthropic.com>

Author: KSXGitHub

.github/workflows/deploy.yaml

@@ -469,6 +469,12 @@ jobs:
 
     runs-on: ubuntu-latest
 
+    environment: release
+
+    permissions:
+      contents: read
+      id-token: write # needed for crates.io Trusted Publishing
+
     steps:
       - uses: actions/checkout@v6
 
@@ -479,11 +485,14 @@ jobs:
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > $installer
           bash $installer --default-toolchain $(cat rust-toolchain) -y
 
-      - name: Login
-        run: cargo login ${{ secrets.CRATE_AUTH_TOKEN }}
+      - name: Authenticate with crates.io
+        id: auth
+        uses: rust-lang/crates-io-auth-action@v1
 
       - name: Publish
         run: cargo publish
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
 
   competing_benchmark:
     name: Benchmark