[mveril]

The beta publication workflow failed with HTTP 403 while checking whether rustiq-chem-core 0.1.0-beta.1 existed. Add a descriptive User-Agent and an Accept: application/json header to crates.io API requests, preserving the existing 200/404 handling and safe failure for all other statuses.

A read-only comparison returned HTTP 403 with default curl and HTTP 404 with the corrected headers. The original logs did not retain the response body, and the comparison's 403 body was empty, so User-Agent rejection is strongly supported but the precise server-side rule is unconfirmed.

The first corrected dispatch passed the API checks but exposed another publication blocker: metadata.json and API response files were created in the release checkout, causing Cargo to reject uncommitted package contents. Store these files in a temporary directory outside the checkout and clean it on exit. Keep Cargo's clean-tree checks enabled.

Validation:

• YAML parsing, Bash syntax checks, and git diff --check passed.
• Executed the workflow's check logic with mocked Cargo/API responses for both unpublished, either already published, both already published, HTTP 403/500, and a mismatched published version. Verified exclusions, all-published output, safe failures, clean checkout, and temporary-file cleanup.
• Initial corrected run: API checks passed; Cargo diagnosed the temporary-file issue before uploading.
• Final publication run: succeeded. Logs confirm both rustiq-chem-core and rustiq-chem version 0.1.0-beta.1 were published. Independent crates.io API checks returned HTTP 200 and yanked: false for both.
• The workflow definition came from fix/crates-api; checkout explicitly selected v0.1.0-beta.1 at dd39cb4f44e91df9a9c9149d0cdd1b9dca1ded2b.
• Only publish-crates.yml was dispatched. No promotion or full release pipeline was dispatched, and no release binaries or GitHub Release artifacts were rebuilt or replaced.
• Remote main, develop, and the existing release tag remain unchanged. The GitHub Release API snapshot, including asset metadata, is identical before and after publication. No history was rewritten.

Documentation impact: reviewed the release guide. No book edit is needed because commands, validation rules, publication behavior, and documented recovery procedures remain unchanged; these changes repair request compatibility and placement of internal temporary files. No book checks were required.

This PR changes only .github/workflows/publish-crates.yml and targets develop. Leave merging to the maintainer.