ci: restore krypt-core + krypt-cli to crates.io publish list after gix-stash upstream lands

[mxaddict]

Tracking issue — temporary state introduced in 0efc35f.

Current state

The publish-crates job in ci.yml skips two of the four workspace crates on tag pushes:

publish_or_skip krypt-platform
publish_or_skip krypt-pkg
# krypt-core + krypt-cli are blocked from crates.io until upstream
# GitoxideLabs/gitoxide#2603 (gix-stash plumbing) lands. ...
# publish_or_skip krypt-core
# publish_or_skip krypt-cli

Why: krypt-core depends on gix from the mxaddict/gitoxide fork (branch feat/gix-stash) and enables the stash + merge features that only exist on the fork. cargo publish validates the dep manifest against the version published on crates.io (gix@0.83.0), which doesn't have those features, and rejects the publish.

Distribution impact:

• crates.io: only krypt-platform + krypt-pkg get published on each release tag. cargo install krypt-cli fails on the new version (resolves to last published 0.2.0 binary, missing every change after the fork-switch in 70d8944).
• AUR / brew / scoop / GH Releases: continue to publish the full binary built from the fork. These are the recommended install paths until this is fixed.

Unblocking dep

Upstream PR: GitoxideLabs/gitoxide#2603 — adds the gix-stash plumbing crate to upstream gitoxide. Once merged and released to crates.io with a version exposing the stash + merge features:

Fix steps (when upstream lands)

1. In crates/krypt-core/Cargo.toml, repoint the three gix-related deps from the fork back to crates.io:

   gix = { version = "X.Y.Z", features = ["...", "stash", "merge"] }
   gix-actor = "X.Y.Z"
   gix-worktree-state = "X.Y.Z"

   (Pick the gix version that exposes the new features.)
2. cargo update -p gix to refresh Cargo.lock.
3. Restore the two publish lines in .github/workflows/ci.yml:

   publish_or_skip krypt-core
   publish_or_skip krypt-cli

4. Drop the temporary cargo-deny relaxations introduced in commit 6cc1b5e:
   • [bans] wildcards = "warn" → "deny"
   • Remove the allow-git entry pointing at mxaddict/gitoxide
5. Cut a new release. publish_or_skip is idempotent; previously-published platform/pkg at the same version skip; new krypt-core / krypt-cli go through cleanly.
6. Close this issue.

Acceptance

• gix-stash available on crates.io with stash + merge features
• crates/krypt-core/Cargo.toml references crates.io gix (no git = ...)
• ci.yml publish-crates step publishes all four crates
• deny.toml restored to pre-fork strictness
• First release after the fix publishes krypt-core + krypt-cli to crates.io successfully