fix: add checkout to upload-binaries, update Cargo.lock, reorder crate publish

- upload-binaries needs a checkout so gh can detect the repo
- Cargo.lock was stale (still referenced 0.2.0)
- publish-crate now runs after upload-binaries (last step)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ewels

.github/workflows/release.yml

@@ -384,6 +384,8 @@ jobs:
     needs: [check-release, create-tag-and-release, build-binaries]
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+
       - name: Download all binary artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # ratchet:actions/download-artifact@v8.0.1
         with:
@@ -400,12 +402,12 @@ jobs:
             /tmp/binaries/*.sha256
 
   # ------------------------------------------------------------------
-  # 5. Publish to crates.io (release only, after all builds)
+  # 5. Publish to crates.io (release only, last step)
   # ------------------------------------------------------------------
   publish-crate:
     name: Publish to crates.io
     if: needs.check-release.outputs.is_release == 'true'
-    needs: [check-release, create-tag-and-release]
+    needs: [check-release, upload-binaries]
     runs-on: ubuntu-latest
     permissions:
       id-token: write