ci: use cargo publish --dry-run to verify packaged crates

[Firestar99]

• use cargo package instead of release-plz to verify packaged crates
  • This failing action shows missing headers lead to CI failure
• release-plz's dry-run doesn't work properly and randomly fails:

release-plz dry-run problems

Half of the time, it succeeds with Warning: release-plz release-pr failed with HTTP 422; continuing with no PRs created.:

• https://github.com/Rust-GPU/spirv-tools-rs/actions/runs/24101495352/job/70394944864#step:3:287
• https://github.com/Rust-GPU/spirv-tools-rs/actions/runs/24129486666/job/70402246110#step:3:287

And the other half it just fails with:

ERROR failed to create ref refs/heads/release-plz-2026-04-09T18-06-58Z with sha 87c458454a0f5222e7d4d1bb8621a8aec8e28bdb

Caused by:
    0: Response body:
       {
         "documentation_url": "https://docs.github.com/rest/git/refs#create-a-reference",
         "message": "Resource not accessible by integration",
         "status": "403"
       }
    1: HTTP status client error (403 Forbidden) for url (https://api.github.com/repos/Rust-GPU/spirv-tools-rs/git/refs)
Error: failed to create ref refs/heads/release-plz-2026-04-09T18-06-58Z with sha 87c458454a0f5222e7d4d1bb8621a8aec8e28bdb

• https://github.com/Rust-GPU/spirv-tools-rs/actions/runs/24097047074/job/70298215853
• https://github.com/Rust-GPU/spirv-tools-rs/actions/runs/24205043710/job/70658560248

Rereading the documentation, it does state:

the --dry-run flag is only added to the release command (the flag isn't added to the release-pr command).

[Firestar99]

This action should have failed due to the packaged release not compiling, but didn't, proving that release-plz release --dry-run does not run cargo package with verification.