fix(ci): wake release-plz back up with git_only, and make idling loud

[filipeforattini]

release-plz has opened no release PR since v0.3.0 — across a month of green runs. release-pr returned {"prs":[]}, release printed nothing to release, no error, no annotation. v0.3.1 had to be versioned and tagged by hand (#45).

Cause

210143b added publish = false to Cargo.toml to stop release-plz comparing versions against the unrelated dit crate (0.0.1, 2022) squatting the name on crates.io. It does stop that — by making release-plz skip the package entirely. Its FAQ:

Release-plz publishes all packages, except: packages with publish = false in the Cargo.toml.

Fix

git_only = true in release-plz.toml is the field that expresses what 210143b actually wanted:

Enable git-only mode, which determines package versions from git tags instead of the cargo registry. The package will not be published to any cargo registry (cargo publish is skipped).

publish = false in release-plz.toml never could do this — the docs are explicit that it "will still use the cargo registry to check what's the latest release", which is the phantom-PR bug #39 chased.

And git_only re-admits a private package: release-plz #2603 — "When a package is marked with publish=false in its manifest, we should still consider it for release if it is git_only=true" — merged 2026-01-23, well inside the 0.3.160 we run. So Cargo.toml keeps its accidental-publish guard and release-plz starts proposing versions again.

Both code comments that asserted the old, wrong model are rewritten in place, since believing them is what caused this.

Making the failure mode visible

The real damage was that idling looks exactly like health. release-plz.yml now warns when release-plz proposes nothing while version-bumping commits sit since the last tag.

Checked against real history: 3 hits across the v0.3.0..v0.3.1 window (the silent period), 0 on a chore/docs-only window, and it catches type!: breaking changes of any type.

Verification

Config-only — nothing to run locally. The real proof is the next push to main: this PR merging should itself make release-plz open a chore: release v0.3.2 PR. If it stays silent, the new warning will now say so instead of passing green.

Open upstream caveat worth watching: release-plz #2693 reports git_only = true still attempting to publish in some setups. Cargo.toml's publish = false is a hard backstop if that bites — cargo itself would refuse.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}