fix: add release token preflight

[bkataru]

Summary

• add a Release workflow preflight job that fails immediately when CARGO_REGISTRY_TOKEN is empty
• make platform artifact builds depend on the preflight so missing publish credentials do not waste build minutes before failing
• document the release hardening in Unreleased

Verification

• python3 -c 'from pathlib import Path; import yaml; data=yaml.safe_load(Path(".github/workflows/release.yml").read_text()); assert "preflight" in data["jobs"]; assert data["jobs"]["build"]["needs"] == "preflight"; print("release preflight yaml ok")'
• executed the preflight shell block with CARGO_REGISTRY_TOKEN removed and confirmed it exits 1 with the intended GitHub Actions error

Linear: DIR1-96