Add caller-owned PyPI Trusted Publishing template

[j7an]

Summary

• add tested reference scripts for PyPI version derivation and prerelease classification
• correct publish-pypi.yml docs now that PyPI Trusted Publishing does not support cross-repo reusable workflows
• document a caller-owned PyPI Trusted Publishing template with no-OIDC TestPyPI verification and first-party GitHub Release creation

Fixes #91

Validation

• rtk bats tests/
• rtk ./scripts/check-inline-sync.sh
• rtk ./scripts/lint-workflow-call.sh
• rtk ./scripts/lint-workflows.sh
• rtk shellcheck scripts/classify-prerelease.sh scripts/derive-published-version.sh

Follow-ups

• migrate dep-rank first and validate with a real release
• migrate nexus-mcp while keeping MCP Registry publish caller-local
• revisit a composite action only if caller copies drift from the canonical scripts/template
• consider deletion or deeper deprecation of publish-pypi.yml in a separate compatibility issue