Publish worktable and worktable_codegen to crates.vip

[pathscale]

Adds a manual-dispatch workflow that publishes both crates to the private registry at crates.vip.

The work happens in api.crates.vip's reusable workflow: cargo package, then the sparse-index entry derived from cargo metadata, then two writes to Tigris — the tarball under If-None-Match: * and the index entry read-modify-written under If-Match. Nothing is installed; the runner image already ships aws and jq.

codegen publishes before worktable, since worktable depends on it and the entry has to be resolvable first.

Manual dispatch on purpose. A published version is immutable, and cargo package embeds the git sha in .cargo_vcs_info.json — so republishing a version from a different commit is refused rather than silently replaced. Run it with dry-run first to see the derived entry without writing.

Secrets CRATES_VIP_TIGRIS_KEY_ID / CRATES_VIP_TIGRIS_KEY_SECRET are already set on this repository.

Consuming side, once published:

cargo install cargo-vip
cargo vip build

[pathscale]

Two notes from the beta.17 consolidation in #87, neither blocking this PR.

This workflow has the same gap the crates.io one had. worktable_dsl is a third publishable crate in this workspace as of #87, and worktable_codegen depends on it by path with an exact version requirement, so it has to be resolvable in the registry before the codegen entry is written. This file publishes codegen then worktable, the same two-step the crates.io publish job had, and that job failed on exactly this:

error: failed to prepare local package for uploading
Caused by:
  no matching package named `worktable_dsl` found
  location searched: crates.io index
  required by package `worktable_codegen`

It needs a third job, dsl with manifest-path: dsl/Cargo.toml, that codegen then needs.

No file conflict with #87. That PR rewrites the publish step inside rust.yml; this one adds a new file. Both can land. If you would rather have one publish story rather than two, say so and I will fold this in.

Left open rather than closed in the PR consolidation, because it is registry plumbing rather than a release change.

[pathscale]

Folded into #87, which is now the single beta.17 PR for this repo. Every commit from this branch is on release/beta17 unchanged, so nothing is lost by closing this. Keeping one PR per repo for the release.