crates.io publish can't resolve internal path deps (workspace not publish-ready) #44

Surfaced during the estate provenance rollout. crates/fslint-cli/Cargo.toml depends on ~10 internal crates via path-only deps with no version:

fslint-core = { path = "../fslint-core" }
fslint-plugin-* = { path = "../../plugins/*" }   (×8)

cargo publish/cargo package reject path deps without a version (crates.io can't resolve them), so the crates.io publish can't work as-is — which is why it only ever failed at release time. The release binaries are already attested (#43), so distribution-by-binary is covered.

Decision needed: is crates.io publishing intended?

• Yes → version every internal crate + publish them to crates.io first (workspace publish ordering), then fslint-cli with versioned deps; then attest the .crate.
• No (binaries-only) → drop the crates.io publish-crate job; the attested release binaries are the distribution channel.

Flagging the decision; the fix differs entirely by answer.