fix(rust): run dist formula hardening from composite #10

	# Self-CI Release
	name: Self-CI Release

	# Stable release tags only. `!v*` keeps the rolling tag this workflow pushes
	# from re-triggering it; pre-release tags are filtered by the step guard below.
	on:
	push:
	tags:
	- '*'
	- '!v*'

	permissions:
	contents: read

	jobs:
	move-rolling-tag:
	runs-on: ubuntu-latest
	permissions:
	contents: write # force-push the rolling major tag
	steps:
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

	- name: Move rolling major tag
	shell: bash
	run: \|
	tag="${GITHUB_REF_NAME}"
	if [[ ! "${tag}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
	echo "::notice::Tag '${tag}' is not a stable release (X.Y.Z) — rolling tag unchanged"
	exit 0
	fi
	rolling="v${tag%%.*}"
	git tag -f "${rolling}" "${GITHUB_SHA}"
	git push -f origin "${rolling}"
	echo "::notice::Moved ${rolling} → ${GITHUB_SHA} (${tag})"

Provide feedback