[codex] pin latest boxcars and release parser 1.3.0

[gankoji]

Problem

Recent Rocket League replays can fail full analysis with Replay is missing parsed network frames, including 973E29BA437C1AA2B54BC6AFE28BA0B3.replay. The replay itself is valid and contains 10,659 frames.

Root cause

Older parser artifacts use a boxcars release that does not recognize the TAGame.PRI_TA:AnonymizedName network attribute. Because the binding parses with NetworkParse::IgnoreOnError, that decoder error is downgraded to network_frames = None, which hides the actionable attribute error behind the missing-frames message.

The repository already resolved boxcars 0.11.5, which supports that attribute, but the manifest used a compatible range rather than an exact pin. The Cargo and Python package versions were also out of sync, while the publish workflow generated a fresh patch version every day instead of publishing an explicitly committed release.

Changes

• Pin boxcars exactly to the current latest release, 0.11.5.
• Synchronize the Cargo and Python package versions at 1.3.0.
• Add the failing replay as a regression fixture and assert that the real IgnoreOnError binding path returns all 10,659 frames.
• Add pull-request and main-branch Rust test coverage.
• Make PyPI publishing deterministic: publish only when the committed version is newer than PyPI, require both manifests to agree, fail closed when PyPI cannot be queried, and remove the daily synthetic version bump.

After this PR merges, the existing trusted-publishing workflow will build and publish sprocket-rl-parser 1.3.0 to PyPI.

Validation

• cargo test --locked
• Workflow YAML parse validation
• Manifest/version/release-gate validation against PyPI (1.3.0 > 1.2.122 at validation time)
• CI-equivalent wheel build using protoc 29.5
• Wheel RECORD verification
• Public Python API smoke test against the regression replay:
  • 10,659 parsed network frames
  • successful full analysis
  • four analyzed players