Add automated release workflow with release-plz

[eshork]

Summary

Adds automated crates.io publishing via release-plz with trusted publishing (OIDC — no API token needed).

• release-plz.toml — workspace config with version groups, semver checks, and changelog generation
• .github/workflows/release.yml — two-job GitHub Actions workflow (Release PR + Publish)

How It Works

On every push to main:

1. Release PR job: release-plz analyzes commits since last release, creates/updates a PR with version bumps and changelog entries
2. Release job: When the release PR is merged, release-plz publishes crates to crates.io in dependency order (libudx → peeroxide-dht → peeroxide) and creates GitHub releases with tags

Configuration Choices

Setting	Value	Rationale
release_always	false	Only publish when the release PR is merged, not on every commit
version_group	All 3 crates in peeroxide group	Versions stay synchronized across the workspace
semver_check	true	Catches accidental breaking changes before publish
git_release_enable	true	Creates GitHub releases with tags automatically
Auth	Trusted publishing (OIDC)	No long-lived tokens — GitHub's OIDC identity is used directly

Setup Required

After merging, configure trusted publishing on crates.io for each crate:

1. Go to https://crates.io/crates/libudx/settings (repeat for peeroxide-dht and peeroxide)
2. Under "Trusted Publishing", add a GitHub Actions publisher:
   • Owner: Rightbracket
   • Repository: peeroxide
   • Workflow: release.yml
   • Environment: (leave blank)

That's it — all future releases are fully automated with no tokens.

Release Flow

1. Push commits to main (via merged PRs)
2. release-plz automatically opens/updates a Release PR with version bumps and changelogs
3. When ready to publish, merge the Release PR
4. Crates are published to crates.io and GitHub releases are created automatically