release: repair public readiness signals

[loadingalias]

What

• align the canonical README and crate Rustdoc install examples, security support matrix, and release intent with rscrypto 0.8.0
• give only the two observed slow RSA cases a larger default-profile nextest timeout budget while leaving the global 120-second limit unchanged
• call the official OpenSSF Scorecard action directly at its immutable, verified v2.4.3 commit and enforce that publishable workflow shape in CI ownership checks
• remove the obsolete local Docker wrapper

Why

The public release documentation advertised older versions, two valid RSA tests could exceed the documented full-test command's global timeout, and Scorecard's publishing service rejected the local wrapper because it could not verify a direct ossf/scorecard-action invocation.

Impact

No cryptographic implementation, public API, dependency, or global test timeout changes. The patch corrects public documentation and narrows CI/test configuration to the failing cases.

Validation

• just test-all — 1,705/1,705 nextest tests passed (one skipped); 218/218 doctests passed
• cargo nextest list --workspace --all-features --message-format json -E <filter> — each override selects exactly one intended RSA test
• cargo doc --workspace --all-features --no-deps
• BASH_ENV= just check-actions
• BASH_ENV= just check-all --skip-feature-matrix — host and all configured cross-platform checks passed
• BASH_ENV= just push — Cargo Rail config, unification, release intent, workflow pins/ownership, and host checks passed before push

The real Scorecard publication path can only be confirmed by the scheduled or manually dispatched GitHub Actions run after merge.