fix(cryptify): release the stranded security fixes as 0.1.28

[rubenhensen]

cryptify's CHANGELOG.md carried two hand-written bullets under ## [Unreleased], one of them citing GHSA-5rhx-xgvv-h78h:

## [Unreleased]

### Security

- require a validated API key on `GET /usage` and reject unauthenticated callers with 401 (GHSA-5rhx-xgvv-h78h)
- compare `cryptify_token` values in constant time, matching the recovery-token path

release-plz inserts each new version section below that heading, so bullets written there are never folded into the release that follows. They sit above the newest version, undated, indefinitely. CLAUDE.md documents this trap; these two were already in it.

Both describe 8531b28 (2026-07-06). I checked the code rather than trusting the note: cryptify_tokens_match uses subtle::ConstantTimeEq, and there is a usage_rejects_unauthenticated_request test. The fixes are real and merged.

They were not alone

cryptify's last release is v0.1.27, 2026-05-16, and 31 commits have merged since. The [Unreleased] section documented two of them. Also sitting unreleased for two and a half months:

• lettre 0.11.21 → 0.11.22 (RUSTSEC-2026-0141)
• a bearer token on /metrics when configured
• generic 5xx response bodies, with detail logged server-side instead of returned

What this does

Writes a dated 0.1.28 section covering the real backlog, derived from the commit subjects rather than hand-summarised, and bumps cryptify/Cargo.toml so release-plz's release job tags it.

Merging this cuts cryptify 0.1.28 and publishes the advisory fix in a dated release note.

On hand-bumping the version

Normally release-plz owns version numbers and a PR should not set them. It cannot do it here. release-plz decides a package changed by looking for commits touching cryptify/, and the imported history carries root-level paths (src/main.rs, not cryptify/src/main.rs), so it sees no cryptify changes and proposes no bump. #278 confirms this: it touches pg-cli and pg-pkg only, both before and after the history graft.

So without a manual bump, nothing ever releases these. After this lands, release-plz has a cryptify-v0.1.28 tag to measure from and normal service resumes.

Verification

cargo test --manifest-path cryptify/Cargo.toml --all-targets → 157 passed. Workspace resolves; the only lockfile change is cryptify's own version.