Build once and publish through protected OIDC promotion

[Claudio9701]

Outcome

Builds one reviewed release bundle from a matching protected tag, produces evidence and provenance, then promotes the exact bundle through human-approved OIDC trusted publishing.

What changed

• separates tag-triggered build from manual protected publication
• validates tag, source, wheel, and sdist versions without editing source
• verifies wheel/sdist metadata and contents and performs a clean install/import
• exports the locked runtime graph, audits it, and generates a CycloneDX SBOM
• creates GitHub build-provenance attestations for both distributions
• stores one immutable 30-day artifact bundle
• revalidates source workflow, repository, success, commit, target, and downloaded artifact before publication
• uses TestPyPI/PyPI OIDC actions with no API tokens
• forbids alpha/beta/RC promotion directly to production PyPI
• creates the GitHub release only after stable PyPI publication succeeds
• documents protected environments/tags, maintainer approval, smoke testing, rollback/yank criteria, and post-release observation

Verification

• actual 0.3.0a0 wheel and sdist build and content validation passed
• release validator accepted TestPyPI and rejects prerelease-to-PyPI
• 3 release-validator tests passed
• full suite: 59 passed, 2 deselected
• Trunk/actionlint/pinact checked 126 files with no issues
• all Actions pinned to immutable SHAs resolved from current official releases

Required maintainer administration

Before first use, human administrators must create protected release-testpypi and release-pypi environments with required reviewers and protected-tag restrictions, configure matching TestPyPI/PyPI trusted publishers, and protect v* tags. Agents are prohibited from doing this or publishing a release.

Stack

Base: #87
Roadmap: #61
Parent: #72

Closes #88