[izar]

Releases are currently built and uploaded to PyPI by hand with a personal login and MFA. That is slow, easy to get wrong, and leaves PyPI, the git tag and the GitHub release free to drift apart.

This adds a tag-triggered workflow that replaces it:

• Pushing a v* tag builds the package and checks the tag matches the version in pyproject.toml.
• The tagged commit must be on the default branch, so only reviewed code can be released.
• Every tag is published to TestPyPI first. Stable tags (vX.Y.Z) then go to PyPI and get a GitHub release, each behind its own protected environment.
• Publishing uses PyPI Trusted Publishing (OIDC): no API tokens are stored anywhere, and PyPI attestations are generated.
• Actions are pinned to commit SHAs and each job gets only the permissions it needs.

Already set up outside this PR: the testpypi and pypi GitHub environments, the trusted publishers on both indexes, and a v* tag ruleset. The workflow was exercised end to end against TestPyPI from a fork.