Makefile targets it should run:

• audit
• verify-dependency-bounds

It should also run cargo-package to verify packagability. It's possible that we should remove the cargo-package check from the release script, so long as we know it was run before the release. Is it practical to run a packaging test in CI? It seems like we do not run cargo-package anywhere in our GitHub Actions.

We should run both the Makefile targets in the package directory, if possible. As it stands, though, verify-dependency-bounds relies on having a second Makefile in the same directory, so that won't quite work.