Separate PyPI and bundle release assets

[anth-volk]

Fixes #434

Summary

This keeps bundle release sidecars out of the PyPI upload directory during the main-branch publish workflow.

Changes included:

• Export bundle sidecar files to release-assets/ instead of dist/.
• Write the bundle verification JSON to release-assets/.
• Explicitly configure pypa/gh-action-pypi-publish with packages-dir: dist.
• Upload GitHub Release sidecars from release-assets/.
• Update the deprecated skip_existing PyPI action input to skip-existing.
• Add a changelog fragment so the next release versions on top of 4.18.1.

Why

The prior publish run passed bundle package metadata verification, but PyPI upload failed because dist/ contained both Python distributions and bundle sidecar files. The PyPI action scans its package directory and rejects non-distribution files such as policyengine-bundle-4.18.1.citation.txt.

Validation

• Parsed .github/workflows/push.yaml with Python YAML loading.
• Ran python scripts/export_bundle_release_assets.py --dist-dir /tmp/policyengine-release-assets-check.
• Ran .venv/bin/python -m build --outdir /tmp/policyengine-pypi-dist-check with network access for isolated build requirements.
• Confirmed /tmp/policyengine-pypi-dist-check contains only the wheel and sdist.
• Confirmed release sidecars are generated separately under /tmp/policyengine-release-assets-check.
• Ran git diff --check.

Note: a focused local pytest command was interrupted because pytest bootstrap hung while importing the full US model parameter tree in this local environment. The touched code path is workflow-only; the export script itself was run directly.