Add manual semantic releases

[luisleo526]

Summary

• add a Run workflow release button with patch, minor, and major choices
• calculate and write semantic versions through tested repository tooling
• create and squash-merge a version-only PR so releases comply with the organization main-branch ruleset
• generate categorized GitHub Release notes from every merged PR since the previous release
• run static, unit, Docker, distribution, metadata, and clean-install checks before creating the release
• pause for protected pypi approval and publish the validated artifacts through Trusted Publishing

Why

The existing workflow required maintainers to edit the version and create a GitHub Release manually. It also could not safely push an automated version commit directly to main, because the organization ruleset requires a pull request. This flow keeps the one-button UX while preserving that repository policy.

Closed-but-unmerged PRs are excluded because their changes were not shipped. The mechanical release PR is labeled skip-changelog; every other merged PR is categorized as breaking, feature, fix, documentation, or other work.

Safety and retry behavior

• releases are serialized and must be dispatched from main
• stale version state fails instead of guessing
• an already merged version bump or tag is reused on rerun
• a version already present on PyPI skips duplicate immutable publication
• the GitHub Release is created only after all artifacts pass validation
• the PyPI job retains only id-token: write permission

Validation

• actionlint
• ruff check .
• ruff format --check src tests scripts
• mypy src
• pytest — 103 passed, 2 optional Docker tests skipped locally
• mkdocs build --strict
• semantic patch/minor/major, targeted-write, and invalid-version tests