[HoungDev]

What changed

• add a manually dispatched release workflow for TestPyPI and PyPI Trusted Publishing
• require an existing vX.Y.Z tag whose version matches pyproject.toml and whose commit belongs to main
• build, inspect, hash, and smoke-test distributions before uploading a one-day artifact
• isolate id-token: write to a two-step publish job using SHA-pinned official actions
• add separate one-time publisher setup documentation and an end-to-end release checklist
• document TestPyPI verification and immutable-release incident handling

Safety model

Pull requests and branch pushes cannot trigger publishing. A maintainer must manually dispatch the workflow from a version tag and approve the selected testpypi or pypi GitHub Environment. No PyPI username, password, API token, or repository secret is used.

The two GitHub Environments have been created with HoungDev as required reviewer, a v*.*.* deployment tag policy, and no secrets. The pending publisher registration on PyPI and TestPyPI remains a documented one-time account action; no package, tag, or release was created by this PR.

Validation

• actionlint 1.7.12 with verified release checksum
• release workflow contract checks for manual-only trigger, isolated OIDC permissions, pinned PyPA action, and absence of secret references
• ruff check .
• ruff format --check .
• pytest --basetemp .test-tmp-trusted-publishing-suite — 48 passed, 93.79% coverage
• isolated wheel and source distribution build plus twine check
• source distribution verified for both release guides
• README/document local-link validation and git diff --check
• GitHub Environment protection rules, deployment tag policies, and empty secret lists verified through the API

Closes #7