When publishing a package with a custom registry, Cargo resolves the dependency registry field to registry-index (#14500). However, registry-index is for internal purposes only and this is not intended as a means for people to bypass the need for .cargo/config.toml (see #12738 for that use case).

We should look into a way to close this hole to avoid people relying on it unintentionally.