Add post-publish verify step (real install + import)

[mstorath]

Summary

Adds a post-publish smoke check to the publish job: after gh-action-pypi-publish finishes, the workflow does a real pip install dcebe from pypi.org/simple/, imports the module, and asserts estimate_bat is exposed on the public API.

DCEBE's first release will exercise this. The import alone proves the wheel installs and the C++ binding loads; a representative estimate_bat(...) call can be added later once the public API is fully finalised in the ongoing port.

PyPI accepting the upload is not the same as `pip install` working. The check catches:

• A renamed module / wrong package name in the workflow (the bug that was silent on CMF for years)
• Broken __init__.py
• ABI / manylinux mismatch
• Missing or broken native binding (C++ extension)

Mirrors the step that landed in CircleMedianFilter during v0.1.7. Same backport landing in parallel for Pottslab, CSSD, L1TV.

Test plan

• First real exercise: the first v*.*.* tag push that ships DCEBE.
• When the public API surface is final, swap the import-only assert for a real estimate_bat(...) smoke call.