THRIFT-6327: Document the credentials the release workflows need in one place

[Jens-G]

Doc-only. Follow-up to the Windows packaging series (#3901, #3893, #3895, #3896, #3898, #3897), all merged.

Six workflows publish something when a GitHub release is published — pypi.yml, release_ruby.yml, release_rust.yml, dotnet-tool.yml, winget.yml, chocolatey.yml. Between them they need one repository variable, two repository secrets and four trusted-publishing policies on the receiving side.

Every one of those was already documented, and no two of them in the same place:

	was documented in
CHOCO_API_KEY	the Chocolatey prose
WINGET_TOKEN	the WinGet prose
NuGet policy + NUGET_USER	a bullet under Third Party Package Managers
PyPI policy	a different bullet in the same list
crates.io, RubyGems policies	nowhere

So a release manager preparing their first release could only find out what needs setting up by reading the whole document, and couldn't tell "not configured yet" from a real failure.

This adds one ### Release Automation Credentials section: what each item is, secret vs. variable, which workflow consumes it, and what happens when it's missing. The per-package prose stays where it is — the new section is the lookup and links into it rather than duplicating it.

Three things worth writing down

• Four of the six hold no stored credential at all. PyPI, RubyGems, crates.io and NuGet publish over trusted publishing, exchanging the run's OIDC token for a short-lived key. What has to exist is a policy naming this repo, the workflow file and the release environment. Only WinGet and Chocolatey use a stored secret, because neither has an OIDC path.
• WINGET_TOKEN must be a classic PAT with public_repo. Fine-grained tokens are not supported by wingetcreate.
• A green run does not prove anything was published. The WinGet and Chocolatey steps deliberately do not fail when their secret is absent — they build and upload the artifact, emit a ::warning:: and print how to publish by hand in the run summary. That keeps a missing secret from failing a release, but it means the summary is what to read, not the tick.

Verified, not transcribed

Every row was checked against the merged workflows rather than written from memory:

• NUGET_USER is referenced as vars. (a variable); WINGET_TOKEN and CHOCO_API_KEY as secrets.
• all six publish jobs carry environment: release
• exactly the four trusted-publishing ones carry id-token: write
• both degrading steps really do exit 0 after their guard, with a ::warning:: and a step-summary block

The table is 7 rows × 4 columns, well-formed, and the #chocolatey anchor resolves.

JIRA: THRIFT-6327

🤖 Generated with Claude Code