publish: change `./publish verify` to use `cargo package` (currently dropped; lost the fail-fast metadata check)

[avrabe]

Background

v0.7.0 publish-to-crates-io.yml failed because the pre-flight ./publish verify step (cargo publish --dry-run -p <name> per crate, in dep order) requires every workspace dep to already exist on crates.io at the new version. For a first publish of any new version, dependents always fail. PR #144 dropped the verify step entirely as the unblock; the actual ./publish publish step has a retry loop that handles index propagation correctly, but we lost the fail-fast packaging-error check.

Proposed fix

Change scripts/publish.rs::verify to call cargo package -p <name> instead of cargo publish --dry-run -p <name>. cargo package:

• Resolves through path deps when available (doesn't need the deps published)
• Builds the .crate file end-to-end
• Catches: missing README/license, wrong include/exclude, broken metadata, code that doesn't compile

…which is the actual surface the verify step is supposed to cover. Then restore the step in .github/workflows/publish-to-crates-io.yml.

Known additional finding

While drafting this issue, cargo package -p synth-abi surfaced a separate bug: crates/synth-abi/Cargo.toml declares a path dep synth-wit = { path = "../synth-wit" } with no version =. Since synth-abi has publish = false it never reaches crates.io, but cargo package still errors on this. Either:

• Add version to the synth-wit dep declaration (consistent with the other path deps after feat(release): crates.io trusted publishing + toolchain SBOM (Phases 4+6) #136), or
• Skip publish = false crates from the verify pass.

Falsification

This issue would be closed wrong if ./publish verify post-fix still fails for the same chicken-and-egg reason (deps not on crates.io). The check should pass on a clean workspace with no prior version on crates.io.

Linked to #145 (the workspace-pin-sweep gap surfaced from the same v0.7.0 release-tail).