ci: automate crates.io + GitHub release publishing via release-plz

[mvanhorn]

Motivation

Closes #3291. Ports Leo's automated crates.io-first publishing flow to snarkVM so that merging a workspace version-bump PR into staging publishes all snarkvm-* crates to crates.io and cuts a single GitHub release, with no manual cargo publish and no long-lived crates.io tokens (uses GitHub OIDC Trusted Publishing).

This covers the in-repo pieces of the issue (steps 1, 2, 6):

• release-plz.toml: disables tags/releases workspace-wide and re-enables them only on the umbrella snarkvm crate (git_tag_name = "v{{ version }}"), so there is exactly one git tag and one GitHub release per workspace version rather than release-plz's default per-crate tags. Every lockstep crate is assigned to a shared version_group so they bump together. snarkvm-testchain-generator is the one workspace member not on the lockstep 4.7.3 line (it is at 0.1.0), so it is set to release = false and kept out of the version group; please confirm that matches your intent.
• .github/workflows/publish-crates.yml: triggers on push to staging (path-filtered to Cargo.toml, **/Cargo.toml, release-plz.toml, and the workflow itself) plus workflow_dispatch with a dry_run input, a concurrency group, a dry-run job (release-plz/action@v0.5, command: release, dry_run: true), and a publish job with contents: write + id-token: write for OIDC Trusted Publishing. Leo's binary-release dispatch is dropped (library workspace), and manual dispatch is guarded to staging only.
• RELEASING.md: documents the normal flow, dry-run, the one-time crates.io Trusted Publishing setup, the new-crate bootstrap, and the tag-collision caveat.

The crates.io per-crate Trusted Publishing enrollment and new-crate bootstrap (issue steps 3-4) are operator-side on crates.io and cannot live in a PR; RELEASING.md documents them.

Test Plan

• actionlint .github/workflows/publish-crates.yml passes.
• release-plz.toml parses as valid TOML; all 65 referenced crate names were cross-checked against the actual workspace Cargo.toml files (exact match, none missing, none invented).
• publish-crates.yml parses as valid YAML.
• The publish job installs lld before publishing, because cargo publish runs verification builds that honor .cargo/config.toml, which forces -fuse-ld=lld on x86_64-unknown-linux-gnu (matching the existing benchmarks.yml).
• End-to-end dry run via workflow_dispatch with dry_run: true is the recommended next validation step once the workflow is on staging; it reports the planned single v{version} tag and the crates release-plz would publish, without publishing.

Documentation

RELEASING.md is added in this PR. No AleoNet/welcome docs changes are needed.

Backwards compatibility

No runtime or consensus behavior changes. This PR only adds release/CI configuration and docs; no Rust code is touched, so no ConsensusVersion guarding is required.

Fixes #3291