Add CI package/publish-surface validation for workspace crates

[SG-devel]

Motivation

• Ensure the package surface for each publishable crate is validated automatically before release so publish-time surprises are caught early.
• Surface publish-order and registry dependency issues (e.g. local path deps) in CI with clear, actionable output.

Description

• Add scripts/validate_publishable_crates.py which runs cargo package --list --locked -p <crate> and cargo publish --dry-run --locked -p <crate> for tailtriage-core, tailtriage-tokio, and tailtriage-cli, printing per-command output and collecting failures.
• Aggregate failures and print a concise summary with the last error line for each failing command so CI reveals all package/publishability problems in one run.
• Wire the script into .github/workflows/ci.yml as a Validate publishable crates step on the dev matrix profile to keep validation maintainable and scoped.
• Keep the checks strictly dry-run and non-publishing; the script exits non-zero on detected package validation issues.

Testing

• Ran cargo fmt --check and it passed.
• Ran cargo clippy --workspace --all-targets -- -D warnings and it passed.
• Ran cargo test --workspace and all tests passed.
• Ran python3 scripts/validate_publishable_crates.py which correctly exercised the new checks and reported failures: tailtriage-core dry-run succeeded but tailtriage-tokio and tailtriage-cli dry-run failed due to their dependency on tailtriage-core not being available on crates.io, demonstrating the script surfaces publish-order assumptions as intended.

---

Codex Task

[SG-devel]

This PR correctly implements the package-surface validation flow for #199, but it is expected to fail until the publish dependency chain is available on crates.io. Marking it as a merge candidate once the prerequisite published crates exist and the dry-run checks can succeed as intended.