Add guarded initial crates.io publication

[konojunya]

Summary

• Add a main-only, exact-commit bootstrap workflow for stack-compiler 0.1.0.
• Require successful CI, exact package/license/MSRV identity, and an unused crate name before a credential-free packaging dry run.
• Expose the short-lived bootstrap secret only to the publication step; document cleanup and the later trusted-publishing handoff.

Verification

• Four publication guard tests, real Cargo metadata, and actionlint pass.
• Stable and Rust 1.85 tests, conformance, formatting, Clippy, and rustdoc pass.
• Coverage: lines 97.92%, functions 98.02%, regions 97.11%.
• Rust 1.85 crates.io publication dry run passes; no crate has been uploaded by this PR.