ci(release): adopt release-plz for library publishing (fleet standard)

trash-core/trash-forensic were hand-published (both at 0.3.1). Add the fleet-standard
release-plz pair (workspace variant: per-crate trash-core-v*/trash-forensic-v* tags, core
before forensic) so future bumps are PR-reviewed and auto-published. Versions are in sync
with crates.io, so this publishes nothing today. Also gitignore /.claude/ (worktree cruft).

Author: h4x0r

.github/workflows/release-plz.yml

@@ -0,0 +1,60 @@
+name: release-plz
+
+# Owns crates.io publishing + changelogs + version bumps for the workspace libraries
+# (trash-core, trash-forensic). Configuration lives in release-plz.toml.
+#
+# On every push to main:
+#   - release-plz-pr:      opens/updates a human-reviewed version-bump PR
+#   - release-plz-release: publishes any crate whose version is ahead of crates.io
+#                          (release-plz resolves dependency order: core before forensic)
+#
+# trash-forensic is a library workspace (no binary), so there is no release.yml / v[0-9]* tag;
+# release-plz cuts per-crate `trash-core-v*` / `trash-forensic-v*` tags.
+
+permissions:
+  contents: write
+  pull-requests: write
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: release-plz-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release-plz-release:
+    name: release-plz release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 0
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      - name: release-plz release
+        uses: release-plz/action@e8792575c7f2366cf6ff3ccc33ead9ace5b691c7 # v0.5.130
+        with:
+          command: release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+
+  release-plz-pr:
+    name: release-plz PR
+    runs-on: ubuntu-latest
+    concurrency:
+      group: release-plz-pr
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 0
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      - name: release-plz release-pr
+        uses: release-plz/action@e8792575c7f2366cf6ff3ccc33ead9ace5b691c7 # v0.5.130
+        with:
+          command: release-pr
+        env:
+          GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_TOKEN || secrets.GITHUB_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

.gitignore

@@ -1 +1,4 @@
 /target
+
+# Claude Code worktree / session data — never part of the repo
+/.claude/

release-plz.toml

@@ -0,0 +1,38 @@
+# release-plz owns crates.io publishing + changelogs + per-crate version bumps for the
+# workspace libraries (trash-core, trash-forensic). It runs on pushes to main
+# (see .github/workflows/release-plz.yml):
+#   - `release-pr`  opens a human-reviewed version-bump PR (conventional commits)
+#   - `release`     publishes any crate whose Cargo.toml version is ahead of crates.io,
+#                   in dependency order (core before forensic), and tags it
+#
+# Both members publish; the fuzz crate is a detached [workspace] (not a member), so no
+# per-package publish=false override is needed. Per-crate tags are `trash-core-v0.3.2`
+# etc. — crate-prefixed, so they never match a `v[0-9]*` binary trigger.
+
+[workspace]
+git_tag_enable = true
+git_release_enable = false
+changelog_update = true
+dependencies_update = false
+# Only prepare a release on a real change. release-plz's detection is file-based, so a
+# changelog-only "chore: release" commit otherwise re-triggers a release (the churn
+# loop). This allowlist makes feat/fix/perf/refactor/doc/revert the only triggers.
+release_commits = "^(feat|fix|perf|refactor|doc|revert)"
+
+[changelog]
+commit_parsers = [
+    { message = "^chore\\(release\\):", skip = true },
+    { message = "^chore: release", skip = true },
+    { message = "^feat", group = "added" },
+    { message = "^fix", group = "fixed" },
+    { message = "^perf", group = "performance" },
+    { message = "^refactor", group = "other" },
+    { message = "^doc", group = "documentation" },
+    { message = "^revert", group = "other" },
+    { message = "^style", skip = true },
+    { message = "^test", skip = true },
+    { message = "^ci", skip = true },
+    { message = "^build", skip = true },
+    { message = "^chore", skip = true },
+    { message = "^.*", group = "other" },
+]