ci: add PyPI trusted-publishing workflow

[roli-lpci]

Adds the canonical release-triggered publish.yml (OIDC trusted publishing). Fires only on a GitHub Release. No logic/docs changes. 🤖 Generated with Claude Code

[github-actions]

PyGate Quality Gate Results

PyGate Agent Brief — run_20260606214749_92774818

Mode: canary
Status: fail
Summary: 2 deterministic finding(s) require repair.

Findings & Actions

lint_exit_127

• Action: Apply targeted ruff fixes and re-run lint deterministically.
• Scope: multi_file
• Rationale: lint failed deterministically. Address this before any inferred optimizations.

typecheck_exit_127

• Action: Resolve Pyright type errors for impacted files and re-run typecheck.
• Scope: multi_file
• Rationale: typecheck failed deterministically. Address this before any inferred optimizations.

Retry Policy

• Max attempts: 3
• Max patch lines: 150
• Abort on no improvement: 2 consecutive attempts

Escalation

• Required: True
• Reason: UNRESOLVED_DETERMINISTIC_FAILURES
• Message: Escalate with evidence packet if bounded repair loop cannot clear deterministic failures.