ci(release): publish the Rust client to crates.io from the core v* tag

[devin-ai-integration]

Stacked on #738 (base: feature/release-java-client-on-core-tag). Merge #738 first; this PR then retargets to develop.

What and why

The Rust crate opensysml is now published the way the Python, Node and Java clients are: from the core v* tag, in the core release workflow, at the core's version. It replaces the maintainer-run cargo publish and the opensysml-rust-v* tag, which was never used. The name opensysml is free on crates.io.

Version lock

• client/rust/opensysml/Cargo.toml is set to 0.9.0, matching develop's _version.py; the release branch bumps it to 0.9.1. Cargo.lock changes by one line, opensysml's version. opensysml-conformance keeps its own version because it is publish = false.
• check_version.py --rust reads the [package] version with a line scan, not tomllib, because Python 3.10 is still supported. It goes through the shared _client_version, so it uses the same SemVer→PEP 440 translation and exact-tag rule as --node/--java (0.9.0-rc.1 ↔ 0.9.0rc1). A version = in any other table doesn't count. --rust is added to the mutually exclusive group, and build-python-package exports RUST_VERSION.
• New tests cover the Rust version checks and the Cargo.lock opensysml entry, which must name the Cargo.toml version.
• scripts/ci-changed-areas.sh: changes to client/rust/opensysml/Cargo.toml and client/rust/Cargo.lock now run the Python suite. So do changes to editors/cameo/pom.xml and editors/syson/backend/pom.xml, which fixes a gap an automated review found on ci(release): publish the Java client to Maven Central from the core v* tag #738: the Java consumer-reference test lives in the Python suite, but those poms didn't trigger it. The cameo-only/syson-only cases became cameo-manifest/syson-backend-manifest and gained python; nothing else in any emit changed.

publish-crates job (rust-executor, context: [crates.io]). The token is CARGO_REGISTRY_TOKEN from the restricted org context crates.io. It requires Publish GitHub release and Rust client tests, and runs beside the other three registry jobs, independent of them. rust-test was added to the release workflow; it builds its own sysml-grpc. Publish GitHub release now also requires it.

Everything that can fail runs before the upload:

1. Fail on an empty CIRCLE_TAG. The version comes from cargo pkgid (…#0.9.0 → ${pkgid##*[#@]}), and the tag must equal v<version>.
2. CARGO_REGISTRY_TOKEN must be non-empty; only its name is printed.
3. GET https://crates.io/api/v1/crates/opensysml/<version> with a User-Agent header, which crates.io requires. 200 → refuse (a version can only be yanked, never replaced); 404 → proceed; anything else → refuse rather than guess. I checked this live: serde/1.0.0 returns 200 and opensysml/0.9.0 returns 404.
4. cargo package -p opensysml --locked is the dry run.
5. cargo publish -p opensysml --locked --no-verify. Step 4 already verified the package, and cargo reads the token from the environment, so nothing is written to disk.

Pre-releases publish as ordinary crates.io versions; Cargo selects them only when a consumer names one exactly.

The Maven Central context for publish-maven lands in #738 and is merged into this branch; this PR adds only the crates.io context. releasing.md lists all four contexts (PyPI, npm, Maven Central, crates.io) that whoever pushes the tag must be allowed to use.

Known limitation, unchanged here. The crate's auto-download verifies only against the digests pinned in its embedded release-digests.json, which currently runs through v0.3.0. A published crate therefore cannot download the sysml-grpc binary of its own release. It targets a running service or a binary it is pointed at ($OPENSYSML_GRPC_BINARY, then sysml-grpc on $PATH). The Rust docs now say so plainly.

Docs. releasing.md:

• The Rust section is rewritten for the core-tag model: the token in the crates.io context, token expiry, the version lockstep, the job's steps, pre-releases, yank-only immutability, and what can be rerun.
• The intro now says no client keeps its own tag.
• The release checklist adds the Cargo.toml bump and cargo update -p opensysml, and the tagging text lists Cargo.toml among the files the tag must match.
• "What CircleCI publishes" covers the new job, and a crates.io check is added to "After the release". That step also fixes the list's existing mis-numbering.

Also updated: client/rust/README.md (opensysml = "0.9" plus the limitation), docs/guide/09-clients.md, docs/reference/rust-api.md, the root README and the roadmap. The changelog fragment is changes/unreleased/rust-client-crates-release.added.md.

How it was verified

• cargo package -p opensysml --manifest-path client/rust/Cargo.toml --locked is clean.
• OPENSYSML_REQUIRE_SERVICE=1 cargo test --workspace passes against a local sysml-grpc.
• pytest tests/test_check_version.py tests/test_version.py passes; no existing test was changed.
• bash scripts/ci-changed-areas-test.sh passes (33 cases).
• circleci config validate, python3 scripts/changelog.py check, python3 scripts/check-doc-links.py (0 broken), make docs-check, gofmt -l . and go test ./tests/hygiene/... all pass.

cargo publish was never run in any form, and nothing was published.

Checklist

• make test and make lint pass locally (the affected suites above)
• Tests added or updated for the change
• Documentation extended where it already covers the surface (see CONTRIBUTING.md)
• Changelog entry added as changes/unreleased/<slug>.<section>.md, not as an edit to CHANGELOG.md
• baselines regenerated and make docs-counts run if a gate count moved (no gate count moved)
• No internal work-item labels (waves, slices, F4, K5) in the body, docs, or changelog

Link to Devin session: https://nasa-jpl-demo.devinenterprise.com/sessions/50e350d0913749039440892f390a0f90
Open in Devin Desktop: https://nasa-jpl-demo.devinenterprise.com/desktop/session/50e350d0913749039440892f390a0f90?variant=devin
Requested by: @HuiJun

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring