Check the Rust crate's public API against the pull request's base, and package it in the gate
Third of three CI-hardening pull requests for the Rust crate (card: hey-sdk Rust: CI hardening). Stacked on #157 (which is on #155); the diff here is only the API-compatibility gate and the packaging check. Merge those first.
What changes
api-compat-rust is the Rust counterpart of the Go api-compat job: cargo-semver-checks over hey-sdk on the branch against the same crate at the pull request's base commit, judged by the version in Cargo.toml. A PR that leaves the version alone may add but not break; one that bumps it (0.x → 0.y is a major under pre-1.0 semver) may break. The breaking label skips the job, as it does for Go. Runs on the pinned stable from rust-toolchain.toml (rust-toolchain: manual).
The baseline is the PR base rather than a release tag because v0.29.0 predates rust/; once a Rust-bearing tag exists (after the publishing PR and the next release) the job gains that second baseline.
make rs-publish-check runs cargo package -p hey-sdk --locked, which builds the crate from its own tarball, and make rs-check ends with it. A file the package leaves out, a path dependency, a metadata slip: found on the PR, not on the tag. It is cargo package and not cargo publish --dry-run only because the crate still says publish = false; the publishing PR flips both.
Verified locally: cargo semver-checks check-release -p hey-sdk --baseline-rev origin/main → 196 checks pass, 58 skip, no semver update required; make rs-publish-check green (the tarball currently ships tests/, which the publishing PR's include allow-list trims); make rs-check green; actionlint and zizmor clean apart from the pre-existing self-repository note.
Merge order
This PR is part of a five-PR stack, each rebased on the one below and all five on current main, so they merge cleanly in this order and only this order: #155 (build/MSRV/feature matrix) → #157 (cargo deny, Dependabot, Trivy) → #159 (semver-checks, packaging) → #160 (docs, examples, rustfmt) → #162 (crates.io publishing). Every one of them touches .github/workflows/test.yml and/or the Makefiles; the stacking is the conflict resolution. Merge each one after the one below has landed; GitHub retargets the next PR to main when the merged branch is deleted. #162 can merge before the crates.io bootstrap: it publishes nothing until the crate exists on crates.io (its publish job fails closed with instructions on a tag until then), and nothing in it changes after the bootstrap.