Add GitHub Actions workflows for CI and automated PyPI publishing

[jcpitre]

Closes #3

What this adds

• python-test.yml — runs the test suite on Python 3.10–3.13 on every release or manually.
• python-release.yml — triggered when a GitHub Release is published. Runs the full test matrix first, then builds and publishes the package to PyPI using Trusted Publisher (OIDC) — no API token required.

How to cut a release

See the new Releasing a New Version section in README.md.

⚠️ Post-merge requirements

These workflows can only be fully tested after this PR is merged, because:

1. GitHub requires workflow files to exist on the default branch before they can be triggered manually or via workflow_dispatch.
2. PyPI's Trusted Publisher configuration must reference the exact workflow file on the default branch. A maintainer will need to register the Trusted Publisher on PyPI (instructions) pointing to MobilityData/gtfs-diff-engine, workflow python-release.yml, environment pypi.

Recommended follow-up (requires admin): Enable branch protection on main to require ci.yml status checks to pass before merging. This prevents a release from being cut from a broken main. Go to Settings → Branches → Add branch ruleset, and require the test, lint, and models-freshness jobs as required status checks.

[cka-y]

I believe this is already covered by ci.yml

[jcpitre]

Do we want tests to run before release? Or do we trust that ci.yml ran properly?
python-test.yml is essentially called from python-release.yml.
It could have been embedded in python-release.yml.

• ci.yml is a smart gate — runs conditionally on path changes, designed for PR feedback speed
• python-test.yml is a release safety net — runs unconditionally, designed for correctness at publish time

I suggest we keep both.