ci: update workflow triggers and release publishing

[Teingi]

Which issue or RFC does this PR close?

No linked issue or RFC.

Rationale for this change

Development now targets master, while the customer-artifact and Docker-image workflows are expensive and should run only when explicitly requested. The Release workflow also needs to publish an auditable wheel/sdist pair to PyPI without a repository token.

What changes are included in this PR?

• Rename main.yml to master.yml and move push triggers from main to master for the primary CI and E2E workflows.
• Make customer artifact and Docker image builds manual-only through workflow_dispatch.
• Remove the now-unreachable automatic Docker Hub Release publishing path while retaining multi-platform archive builds, the amd64 smoke test, and artifact upload for manual runs.
• Replace on-release-main.yml with release.yml.
• Build and validate wheel/sdist distributions once, persist them as the release-dists Actions artifact, and publish that exact artifact to PyPI through Trusted Publishing (OIDC).
• Keep documentation deployment gated on successful PyPI publication.

Are there any user-facing changes?

There are no runtime API or persisted-data changes. CI behavior changes: customer and Docker artifacts must now be started manually, and publishing a GitHub Release no longer publishes a Docker Hub image. PyPI must trust the release.yml workflow before the next release.

How was this change tested?

• make check
• validation_dir=$(mktemp -d)
• uv build --out-dir "$validation_dir/dist"
• uvx --from twine twine check "$validation_dir/dist"/*
• Verified the release-version script with RELEASE_TAG=v0.0.1, including the case where the tag matches the existing project version.

The local build produced a valid wheel and source distribution. A live GitHub Release/PyPI publication was not performed.

AI usage statement

OpenAI Codex was used to inspect, edit, and validate the workflow changes and to prepare this pull request.

[PsiACE]

Everything else looks good to me. I’d remove live-replay for now, given the leak risk discussed in #1208, and bring it back once evidence is scanned before upload. I can approve after that.