[M8] cargoxx publish: open a recipe PR via tea / Gitea API

CHANGELOG.md

@@ -528,3 +528,38 @@ All notable changes to cargoxx will be documented in this file.
   Codegen unchanged — the synthesized recipe (find_package +
   `<name>::<name>` target) is identical to the path-dep case, just
   with a different `linkdb_source` discriminator.
+- M8 `cargoxx publish` (Phase 2c). Publishes the project's HEAD as a
+  new version recipe in a Gitea-hosted cargoxx registry. Steps:
+  1. Validate `Cargoxx.toml` has `name`, `version`, `license`.
+  2. Verify the working tree is clean and `Cargoxx.lock` exists.
+  3. Reject path-dep deps (registry can't reference local trees).
+  4. Read `git remote get-url origin` + `git rev-parse HEAD`,
+     normalize SSH URLs to https.
+  5. Compute the source SRI hash via `nix flake prefetch
+     git+<url>?rev=<commit> --json`.
+  6. Build the recipe TOML (mirrors `Cargoxx.toml`'s deps + `[meta]`).
+  7. POST `/repos/<registry>/contents` with `{branch: "master",
+     new_branch: "publish/<name>-<version>", files: [...]}` — a
+     single atomic commit creating both `recipes/<name>/versions/
+     <v>.toml` and (for new packages) `recipes/<name>/maintainers.txt`
+     pre-populated with the publisher's Gitea username (`tea api
+     /user`).
+  8. POST `/repos/<registry>/pulls` to open the PR.
+
+  `--dry-run` prints the recipe TOML and exits without any network
+  ops. `--registry <owner>/<repo>` overrides the default
+  (`$CARGOXX_REGISTRY`, falling back to `mozart/cargoxx-pkgs`).
+  Authentication comes from `tea login` — no separate token plumbing.
+
+  Manifest schema gains three optional `[package]` fields used in the
+  recipe's `[meta]` block: `description`, `repository`, `homepage`.
+
+  The cargoxx wrapper (`flake.nix`'s `cargoxxRuntimePath`) now bundles
+  `pkgs.tea` so the binary can shell out to it on non-Nix hosts.
+
+  Verified end-to-end against
+  `https://git.amadey.xyz/mozart/cargoxx-pkgs`: from a
+  `mozart/greeter` checkout, `cargoxx publish` opens PR #3 with
+  branch `publish/greeter-0.1.0` containing a fresh
+  `recipes/greeter/versions/0.1.0.toml` and a new
+  `recipes/greeter/maintainers.txt`.