Fix release preflight: Clippy, Integration workflow, and publication cycle

[salasebas]

Context

The 0.3.2 release PR cannot be published safely yet. The previous 0.3.1 release was left partially published, and current CI does not reliably validate the code or publication graph.

This issue groups the three release-infrastructure blockers that must be resolved before refreshing and merging #203.

1. Restore green Clippy on main

The current CI run fails Clippy with Rust 1.97 at:

• crates/rustauth-core/src/utils/url.rs:99
• lint: clippy::question_mark
• failing run: https://github.com/salasebas/rustauth/actions/runs/29517299433

Run and fix:

cargo clippy --workspace --all-targets --all-features -- -D warnings

2. Repair the Integration workflow

.github/workflows/integration.yml declares workflow_dispatch twice:

  workflow_dispatch:
  workflow_dispatch:

GitHub rejects the workflow before creating any jobs. The failing run has no executable jobs/logs:

https://github.com/salasebas/rustauth/actions/runs/29517298193

This matters because the standard CI workflow does not cover all adapter/integration crates that depend on Integration, including the live storage paths.

3. Break the rustauth / rustauth-fred publication cycle

The previous release run published six crates at 0.3.1 and then failed while packaging rustauth-fred:

https://github.com/salasebas/rustauth/actions/runs/28576197389

The cycle still exists for 0.3.2:

• rustauth-fred dev-depends on the same-release rustauth, rustauth-plugins, and rustauth-redis.
• The rustauth facade normally/optionally depends on rustauth-fred.
• publish_no_verify = false.

Therefore rustauth-fred cannot verify before rustauth exists on crates.io, while rustauth cannot verify before rustauth-fred exists. There is no valid clean publication order.

Move the cross-crate/live tests into an unpublished test crate, or otherwise remove same-release unpublished dev-dependencies from published crates. Update RELEASE.md to reflect the real dependency graph and publication order.

Acceptance criteria

• cargo clippy --workspace --all-targets --all-features -- -D warnings passes on the CI toolchain.
• .github/workflows/integration.yml is valid and creates/runs all intended jobs.
• The published-crate dependency graph is acyclic, including dependencies needed by Cargo package verification.
• A clean release preflight proves that every crate can be packaged/published in the documented order without depending on a not-yet-published same-version crate.
• RELEASE.md reflects the verified order.
• chore: release v0.3.2 #203 is regenerated/refreshed after these fixes and receives real Rust CI and Integration checks.

Notes

Version 0.3.2 remains the correct next version because crates.io already contains the six partially published 0.3.1 crates. If 0.3.2 is also partially published, another version skip would be required.