docs: externalize crate publishing to Microsoft internal OSS infrastructure

[Pino de Candia (pinodeca)]

This PR documents that duroxide crate publishing is handled by Microsoft's internal OSS release infrastructure, removing the manual \cargo publish\ responsibility from public contributors.

Changes

• NEW: \RELEASE_POLICY.md\ — Complete documentation of the release model, including internal publishing workflow, contributor responsibilities, and crates.io trust model
• UPDATED: \prompts/duroxide-crate-release.md\ — Removed manual \cargo publish\ step; points to RELEASE_POLICY.md; updated post-release expectations for automatic GitHub Release creation
• UPDATED: \README.md\ — Added one-line notice that releases are published internally with link to RELEASE_POLICY.md

Why This Change?

• Clarity: Removes ambiguity about who publishes duroxide to crates.io
• Security: Publishing credentials are not distributed to public contributors
• Compliance: Internal pipeline includes SBOM, security scanning, and audit logs
• Consistency: Every release follows the same validated process

For Reviewers

• ✅ No code changes; documentation only
• ✅ No breaking changes to contributor workflow (version bump → merge → tag still works)
• ✅ CI.yml (build/test) continues unchanged
• ✅ Crates.io trust model documented (HTTPS + tokens; no cryptographic signatures)
• ✅ Internal tooling details not exposed

See \RELEASE_POLICY.md\ for full publishing infrastructure context.