[CI] Try to fix publishing step

[hildebrandmw]

The "Verify tag is on main branch" step always fails on tag pushes because git branch --contains only lists local branches. In GitHub Actions, main exists only as the remote-tracking ref origin/main, so the grep never matches. You can try this locally with a fresh clone from main and running git checkout v0.52.0. An example failure is here

Replaced with git merge-base --is-ancestor which directly checks reachability from origin/main without requiring a local branch.

[Copilot]

Pull request overview

This PR fixes the tag-on-main verification in the crates.io publish workflow for tag pushes in GitHub Actions by switching from local-branch inspection to a reachability check against origin/main.

Changes:

• Replace git branch --contains ... | grep main with git merge-base --is-ancestor ... origin/main to correctly validate tag commits on CI.
• Keep the existing failure behavior/message when the tag does not point to a commit reachable from origin/main.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.51%. Comparing base (c7dfae6) to head (2828d9a).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1057   +/-   ##
=======================================
  Coverage   89.51%   89.51%           
=======================================
  Files         461      461           
  Lines       85920    85920           
=======================================
  Hits        76912    76912           
  Misses       9008     9008           

Flag	Coverage Δ
miri	89.51% <ø> (ø)
unittests	89.14% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.