Add a `--no-implicit-publish` flag to `cargo publish --workspace`

[t-moe]

Problem

We use cargo publish --workspace in our CI/CD pipeline to release multiple crates.

The problem is that newly added workspace members inherit the default publish behavior, equivalent to not setting the publish field at all. For example, if a user adds a new test or example crate (e.g., via cargo add hil-tests, which sets publish = null), our pipeline attempts to publish it unintentionally.

Proposed Solution

To prevent accidental publication of crates that haven't explicitly opted into being published, we request a new flag for cargo publish (e.g., --no-implicit-publish). When this flag is used, cargo publish should fail (bail) if any crate being considered for publishing does not have an explicit publish setting of either publish = false or a specific list of registries (e.g., publish = ["my-registry"]). This would force developers to make an explicit decision about publication status, significantly reducing the risk of accidental releases.

Notes

No response

[epage]

I can understand the annoyance with the default being package.publish = true. However, I'm unsure if a flag is the right approach. This depends on the use case for cargo publish. If its a plumbing command, then the calling tool is responsible for passing it and it doesn't matter. If its an end-user command, then having to always pass in a flag that is required for use with a workspace is not ideal.

We have talked about changing the default to package.publish = false in #6153. A workaround would be to set workspace.package.publish = false and then cargo new will automatically apply that to new packages.