Redesign release pipeline with manual tagging, split PyPI/TestPyPI workflows, and OIDC publishing

[mkumar73]

Redesign the release flow so stable and RC releases are published from tags, PyPI and TestPyPI are handled separately, and publishing uses OIDC Trusted Publishing instead of long-lived tokens.

Benefit: safer releases, clearer release flow, and better control over what gets published.