ci: Make crates.io publish step idempotent

Check if the version is already published before attempting cargo
publish, so re-running the workflow after a partial failure (e.g.,
GitHub Release 403) doesn't fail on the already-published crate.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: cdecker

.github/workflows/release.yml

@@ -447,15 +447,18 @@ jobs:
       - name: Publish to crates.io
         if: steps.parse.outputs.dry_run == 'false'
         run: |
-          echo "🚀 Publishing ${{ steps.parse.outputs.crate }} v${{ steps.parse.outputs.version }} to crates.io..."
-
-          # -p flag: Publish only this specific crate from the workspace
-          # CARGO_REGISTRY_TOKEN: Authenticates with crates.io
-          # This token should be added to GitHub Secrets as CRATES_IO_TOKEN
-          cargo publish -p ${{ steps.parse.outputs.crate }}
+          CRATE="${{ steps.parse.outputs.crate }}"
+          VERSION="${{ steps.parse.outputs.version }}"
+          echo "🚀 Publishing $CRATE v$VERSION to crates.io..."
 
-          echo "✅ Successfully published to crates.io!"
-          echo "🔗 https://crates.io/crates/${{ steps.parse.outputs.crate }}"
+          # Check if this version is already published (idempotent retries)
+          if cargo search "$CRATE" --limit 1 | grep -q "^$CRATE = \"$VERSION\""; then
+            echo "✅ $CRATE v$VERSION is already published on crates.io — skipping"
+          else
+            cargo publish -p "$CRATE"
+            echo "✅ Successfully published to crates.io!"
+          fi
+          echo "🔗 https://crates.io/crates/$CRATE"
         env:
           # The token is stored in GitHub Secrets for security
           # To create one: https://crates.io/settings/tokens