feat(obs): migrate publishers, hooks, and gitlab forge to tracing

[BryanFRD]

Part of #513 — the println!/eprintln! → tracing migration.

The tracing foundation already exists (src/logging.rs: init_logging + the
MessageOnly human formatter, the --log-format {human,json} / --verbose
flags, deps under the cli feature). This migrates the first, smallest-blast-radius
modules onto it so the pattern is established on real code:

• src/publishers/mod.rs — the "N publishers", published / skipped / dry-run
  status lines → tracing::info!; the publish error → tracing::error!.
• src/publishers/cargo.rs — the transient-retry notice → tracing::warn!.
• src/hooks/runner.rs — the ⊙ dry-run / ▸ running indicators →
  tracing::info!; the hook-failed warning → tracing::warn!.
• src/forge/gitlab.rs — the --draft unsupported warning → tracing::warn!.

Level mapping: always-shown status → info!, warnings → warn!, errors →
error!. The colored ✓ ▸ ⊙ ↻ → prefixes stay inside the message string, and the
MessageOnly formatter renders the message verbatim (via format_args Debug — no
quotes, no level/timestamp), so terminal output is byte-identical to before.

Behavioural note: the human layer writes to stderr (as the committed
logging.rs already dictates), so these status lines move from stdout → stderr.
That's the intended split — logs on stderr, --json data stays on stdout
(those println!(serde_json) sites are deliberately left untouched). The child
process passthrough in hooks/runner.rs (eprint! of a failed hook's captured
output) also stays as-is — it relays subprocess bytes, not a ferrflow event.

Verified: cargo build clean, 669 lib tests pass, cargo fmt --check +
cargo clippy clean.

Remaining stages (follow-up PRs, per the issue's "not one giant PR"): src/validate/,
src/config/, src/monorepo/ (has if verbose && !quiet gates to fold into
debug!), and the src/ root (~92 sites, the bulk), then the docs/observability/logs.md
schema + OTLP.