ci: configure verified PyPI releases

[nkavian]

Summary

• Add a manual release workflow with a safe dry-run default and a main-only publishing job.
• Verify repository gates, shared conformance, Node interoperability, and the exact distribution files before upload.
• Publish through PyPI Trusted Publishing, attest artifacts, verify the registry wheel, and create the immutable tag and GitHub release.
• Reject conflicting published files and retain verified artifacts for failed-job recovery.
• Document the exact publisher settings and release steps.

Verification

• Full local repository gates passed with 874 tests.
• Candidate wheel/source build, isolated consumers, and the read-only PyPI conflict check passed.
• The PR runs the release verification job without publishing.

No package, tag, or release has been published. The PyPI pending publisher still requires owner configuration.