Switch stable publish to PR-based version bump

[JE-Chen]

Summary

• Replace the direct-push-to-main version bump (blocked by branch protection: required signed commits + PR-only) with a PR flow
• CI creates a release/bump-v<version> branch and pushes the bumped stable.toml + dev.toml via the GraphQL createCommitOnBranch mutation, producing a signed commit
• Workflow then opens a PR with [skip ci] in title/body and tries gh pr merge --squash --auto --delete-branch; if auto-merge is unavailable the PR is left open for manual merge
• The GitHub Release tag now targets the signed bump commit SHA so it survives whether or not the PR ever merges

Test plan

• Merge this PR to main and confirm the publish job completes end-to-end
• Verify the auto-generated bump PR is signed, has [skip ci], and either auto-merges or stays open cleanly
• Confirm the PyPI upload and GitHub Release (tagged at the bump commit) succeed

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{TIP This summary will be updated as you push new changes. Give us feedback}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud