docs: include details on how downstream products can use the rust release workflow

[purpleclay]

closes #14

Summary by CodeRabbit

• Documentation
  • Added guidance for the reusable Rust release workflow, including configuration, supported targets, artifacts, publishing, verification, and adoption.
  • Updated the README with workflow details, contracts, commit-SHA pinning practices, and planned SBOM attestation.
• Chores
  • Updated security-scan exclusions to match current workflow line references.
  • Enabled Markdown documentation files directly under the docs/ directory.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: df0965a0-77cc-4750-863e-4710bd6800b7

📥 Commits

Reviewing files that changed from the base of the PR and between 5eec7f3 and 7e33c74.

📒 Files selected for processing (4)

• .github/zizmor.yml
• .gitignore
• README.md
• docs/release-rust.md

---

📝 Walkthrough

Walkthrough

The change documents the reusable Rust release workflow, adds caller guidance, updates README content, allows direct documentation files under docs/, and corrects zizmor exclusion line references.

Changes

Rust release workflow documentation

Layer / File(s)	Summary
Rust workflow contract docs/release-rust.md	Documents caller configuration, inputs, outputs, targets, artifacts, attestations, constraints, verification, and adoption steps.
Repository guidance and tracking updates README.md, .gitignore, .github/zizmor.yml	Updates workflow guidance, states that SBOM attestation is planned, allows direct Markdown files under docs/, and changes zizmor exclusions to line 257.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• purpleclay/release-workflows#2: Introduced the reusable release-rust.yml workflow documented by this change.
• purpleclay/release-workflows#33: Updated zizmor line references for release-rust.yml.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The documentation changes are in scope, but the zizmor reference updates are unrelated to the linked documentation objective.	Remove the unrelated zizmor reference updates, or explain how they are required for the Rust release workflow documentation.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states that the pull request documents downstream use of the Rust release workflow.
Linked Issues check	✅ Passed	The README and release-rust documentation explain how downstream products can use the Rust release workflow, satisfying issue #14.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 14-docs-for-downstream-usage

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/zizmor.yml:
- Around line 7-13: Update both adjacent explanatory comments in the
stale-action-refs configuration to reference release-rust.yml:257 instead of
release-rust.yml:250, keeping the existing ignore entries and rationale
unchanged.

In `@docs/release-rust.md`:
- Around line 100-103: Update step 2 of the Adoption checklist to reference the
configured environment input rather than hard-coding “release”; preserve the
default value of “release” while making the instruction apply when callers
override it, and include the required reviewer setup for that selected
environment.
- Line 81: Update the release documentation around the checksum generation
command to explicitly state that checksums.txt covers the assets already present
in dist and excludes itself, while separately preserving the statement that
attestations cover every asset, including checksums.txt.
- Line 86: Update the release documentation’s version guidance to make the
source explicit: require Cargo.toml’s package version to match the release tag,
or instruct tag-derived values to use github.ref_name. Remove the claim that the
release tag is available through CARGO_PKG_VERSION, while preserving the
shallow-checkout and git-history constraint.

In `@README.md`:
- Line 6: Update the README release-workflow description to replace “no
per-project security plumbing” with precise wording limited to the absence of
per-project secrets and signing-key management, while preserving the existing
SLSA and keyless Sigstore claims.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: ae44afb5-a20d-46b4-868a-41a65da19483

📥 Commits

Reviewing files that changed from the base of the PR and between 888fda4 and 5eec7f3.

📒 Files selected for processing (4)

• .github/zizmor.yml
• .gitignore
• README.md
• docs/release-rust.md