ci: add cargo-release to deps

[conorsch]

Describe your changes

Issue ticket number and link

Adds two more packages to the nix dev again:

• cargo-release
• buf

Both of those tools are critical during release-engineering, so I'm adding them to provide a deterministic way to generate the necessary build inputs.

In this commit the nix env switches to the recently published stable release for 2024-11. That stable release pulls in buf version 1.47.0, which is sufficiently recent to satisfy the "at least 1.32" stipulation we've had in the docs [0] for a while now.

[0] https://guide.penumbra.zone/dev/protobuf#installing-buf

Checklist before requesting a review

• I have added guiding text to explain how a reviewer should test these changes.

• If this code contains consensus-breaking changes, I have added the "consensus-breaking" label. Otherwise, I declare my belief that there are not consensus-breaking changes, for the following reason:

  dev-only, does not change application source code.

Testing and review

If you want to verify behavior locally, following the docs for setting up the nix dev env https://guide.penumbra.zone/dev/dev-env and then check versions:

❯ buf --version
1.47.0

❯ cargo release --version
cargo-release 0.25.10

You should see exactly those versions. Additionally, you should be able to run just protos and confirm no files were modified.

[conorsch]

I regenerated the proto descriptors on main using the new codified version of buf. This opens the door to removing the slightly-too-forgiving check in CI where we ignore modifications to these files:

penumbra/.github/workflows/buf-pull-request.yml

Lines 72 to 91 in c654809

	# We exclude the proto_descriptor file from diff inspection, since
	# different versions of `protoc` can generate non-substantive changes,
	# causing noisy CI failures.
	- name: Compile protobuf specs into rust src files
	shell: bash
	run: |
	./deployments/scripts/protobuf-codegen
	# https://github.com/penumbra-zone/penumbra/issues/3038#issuecomment-1722534133
	git checkout crates/proto/src/gen/proto_descriptor.bin.no_lfs
	git checkout crates/cnidarium/src/gen/proto_descriptor.bin.no_lfs
	s="$(git status --porcelain)"
	if [[ -n "$s" ]]; then
	echo "ERROR: protobuf files must be regenerated and committed."
	echo "Run this command locally: ./deployments/scripts/protobuf-codegen"
	echo "These are the files that reported differences:"
	echo "$s"
	exit 1
	else
	echo "OK: no changes required to protobuf specs"
	fi

but I'm not altering the CI workflows right now. Can circle back on that on a rainy day, in the context of porting more of the CI to reuse the same nix env that we maintain for local dev.