ci: restore rust to publish's needs chain — flakes rooted out

Rust suite is green again after the batch of fixes: approvals SSE resume
race (202e853), warm_pool test-seeded a real agent (696d823), tolerant
health checks on transient docker daemon errors (15cffba), plus the
inherited fmt + clippy nits from the a2a merge. Put rust back in
publish's `needs` so failing tests actually block deploys again — the
whole point of the earlier drop was to unblock the pipeline while the
flakes were investigated, not to permanently remove the safety net.

.github/workflows/ci.yml

@@ -155,17 +155,16 @@ jobs:
   # IP, not by hostname). GW-04's clawmates-deploy.timer rolls forward within
   # ~1 minute of the push. Skipped on PRs.
   #
-  # `rust` and `e2e` are intentionally NOT in `needs`. `rust` has real but
+  # `e2e` is intentionally NOT in `needs`: it launches its own postgres + dex
-  # flaky tests (see the tracking issue) — the approvals SSE race is fixed,
+  # via `docker run` on the host and then reaches them via 127.0.0.1, which
-  # warm_pool timing and a couple others still need per-subsystem work. `e2e`
+  # fails from inside the act_runner container. Migrating e2e to a physical
-  # spins its own postgres/dex via `docker run` on the host and can't reach
+  # build node is a separate task; until then e2e is signal-only, not gating.
-  # 127.0.0.1 from inside the act_runner container. Both still run on every
+  # `rust` was restored to `needs` once the flakes were rooted out (approvals
-  # push as signal, they just don't gate deploys. Restore rust to `needs`
+  # SSE race + warm_pool agent-seeding + a couple health-check ambiguities).
-  # once the suite stabilizes.
   publish:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
-    needs: [gates, frontend]
+    needs: [gates, rust, frontend]
     env:
       REGISTRY: 100.94.185.103:5000
       NAMESPACE: clawmates