feat: split tracefold-receipt / -tile / -crypto out and automate cargo publish

[mahirhir]

Summary

Publish the leaf crates so third-party Rust CLIs and agent harnesses can consume the verification and inverse-escrow primitives natively.

Status update, 2026-09-03 — partly done, and this issue was wrong about the names

Three crates are live on crates.io as of 2026-09-01:

crate	version	downloads
tracefold (the gx CLI)	0.1.2	26
tracefold-core	0.1.2	26
tracefold-api	0.1.2	12

This issue originally asked for gx-core, gx-receipt, gx-tile and gx-crypto. Those are directory names in the workspace, not package names. gx-core is taken on crates.io by an unrelated project, so the published names carry a tracefold- prefix instead. Anyone who took this issue as written would have been told to publish crates that do not exist under names we cannot use.

What is actually left

• tracefold-receipt — the receipt/DSSE types are still inside tracefold-core. Splitting them out is the remaining consumer-facing win, since a verifier only needs the receipt shape.
• tracefold-tile and tracefold-crypto — same story: currently internal, not separately consumable.
• Release automation. There is no cargo publish workflow. The three live crates were published by hand.

Note for anyone picking this up

GitHub Actions on this repo has not started a job since 2026-08-20 — the account's billing is blocked, so any workflow added here cannot be verified by CI until that is resolved. Check locally with cargo publish --dry-run.

[mahirhir]

Status as of 2026-09-01: blocked on naming. gx-core on crates.io is owned by an unrelated project (Galax, a git tooling crate, last published 2026-08), so the crate names in this issue cannot be published as-is. None of our crates are on crates.io today — publishing requires picking a prefix first (for example tracefold-core).

Also stale: the crate list above says gx-receipt / gx-tile / gx-crypto; the workspace ships gx-witness / gx-log instead.