feat(publish): idempotent workspace publish

[weihanglo]

What does this PR try to resolve?

Before this, cargo publish --workspace would fail if any member packages were already published.

After this, it skips already published packages and continues with the rest.

To make sure the local package is really published, we verify the checksum of the newly packed .crate tarball against the checksum from the registry index. This helps catch cases where the package contents changed but the version wasn’t bumped, which would otherwise be treated as already published.

fixes rust-lang/cargo#13397

How to test and review this PR?

Need discussions, FCP, and maybe an unstable flag.

Some other design questions:

• Is this a breaking change to --workspace publish?
• We might want to skip --verify for already published packages.
• Better diagnostics.