[codex] Limit CubeK workspace to t4a publish closure

[shinaoka]

Summary

• Restrict the root workspace members to the five t4a-cubek* crates needed for the temporary tensor4all publish closure plus xtask.
• Explicitly exclude non-target CubeK crates such as cubek-reduce, cubek-fft, and benchmarks from workspace-wide CI commands.

Root cause

After #1 merged, CI still ran cargo clippy --workspace and cargo doc --workspace over every crate under crates/*. Non-published crates such as cubek-reduce are outside the tenferro-required publish closure and do not compile against the pinned t4a-cubecl fork with Complex element support.

Notes

This PR still targets codex/complex-gemm-api, so it does not mix the C32 matmul API implementation diff into main.

Verification

• cargo fmt --all --check
• cargo xtask check format
• cargo xtask check lint
• cargo xtask doc build
• cargo xtask doc tests
• cargo check -p t4a-cubek-matmul --no-default-features
• cargo metadata --no-deps --format-version 1 confirmed only t4a-cubek-{matmul,std,test-utils,quant,random} remain publishable