fix(ci): harden publish-crates checkout against submodule HTTP 500s

Follow-up to #80 (which closed #79). After merging #80, the v0.3.5 tag
push retriggered release.yml. The `release` job succeeded (checkout@v6
cloned the WebARKitLib submodule fine), but `publish-crates` failed
twice in a row with:

  error: RPC failed; HTTP 500
  fatal: expected 'packfile'
  fatal: clone of 'https://github.com/webarkit/WebARKitLib.git' into
         submodule path '...WebARKitLib' failed

GitHub retried once internally; the retry also got HTTP 500. Net result:
crates.io still shipped no tarball, so #79 is effectively still open for
crates.io consumers.

Two changes to publish-crates (release and publish-npm left alone —
release already works, publish-npm doesn't need submodules):

- Bump actions/checkout@v5 -> @v6. The release job on the same run used
  v6 and cloned successfully against the same submodule endpoint; the
  only meaningful difference from the failing publish-crates job was the
  checkout major version.
- Add fetch-depth: 0. Removes --depth=1 from the submodule clone. The
  WebARKitLib repo is ~3.8MB, so full history is effectively free.
  Smart-http shallow-clone negotiation has known edge cases that can
  surface as HTTP 500; a full clone sidesteps that code path entirely.

The `Verify vendored sources` step remains — if the submodule ever
regresses to empty, it fails loudly before cargo publish is reached.

Post-merge action: bump patch (0.3.6) and push the tag to retrigger
publish-crates against this hardened checkout.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: kalwalt

.github/workflows/release.yml

@@ -62,9 +62,10 @@ jobs:
     needs: [release]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           submodules: recursive
+          fetch-depth: 0
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
       - name: Verify vendored sources