Dry-run "cargo publish" to ensure that the workspace is publishable

To prevent a recurrence of #1054 (closed) and similar issues, it would be great to simulate publishing the whole workspace to see whether it works. We can't use cargo publish --dry-run work over the entire workspace, since a crate will not be publishable unless all its dependencies are published.

I guess that our best solution here probably involves:

• Spinning up a local registry containing a minimal copy of the parts of crates.io that we need.
• Simulating a publish to that registry.
• Rolling back the registry to its original state (on success or failure) to avoid having to clone all our dependencies again.

This would be a nice-to-have for a lot of projects; I wonder if somebody has built it already.