release: assert the pin instead of pulling over it
Gate the crates.io publish on clippy and tests
recipe: note why the crates.io token is not passed through Bento
Declare the Bento release config in-repo