[AAASM-1217] ✨ (ci): Add matrix wheel build + PyPI Trusted Publisher workflow

[Chisanan232]

Description

Adds .github/workflows/release-python.yml implementing the GitHub Actions release pipeline called out in Story AAASM-1202:

• Triggers: v*.*.* tag push (real release) and workflow_dispatch (dry-run / staged validation).
• Build matrix (5 jobs):
  • build-sdist — pure-Python source distribution via maturin sdist
  • build-linux-x86_64 — manylinux_x86_64 wheel
  • build-linux-aarch64 — manylinux_aarch64 wheel
  • build-macos-arm64 — macosx_arm64 wheel (macos-14, Apple silicon)
  • build-macos-x86_64 — macosx_x86_64 wheel (macos-13, Intel)
• Binary staging: each platform job downloads the prebuilt aasm sidecar binary from AI-agent-assembly/agent-assembly releases and places it at agent_assembly/bin/aasm so maturin's include glob picks it up at build time. If the upstream asset isn't published yet, the job logs a warning and ships an SDK-only wheel.
• Publish job: gated on all 5 build jobs; downloads every wheels-* artifact, then uploads via pypa/gh-action-pypi-publish using PyPI Trusted Publisher (OIDC). No long-lived API token in repo secrets. Guarded by if: github.event_name == 'push' so workflow_dispatch is build-only.

⚠️ Stacked on AAASM-1215 (PR #53). Cherry-picked commits for the maturin build-backend switch are included so the branch builds standalone; they drop out on rebase once #53 merges.

PyPI Trusted Publisher setup (one-time, outside this PR)

After merge, complete these manual steps before tagging a release:

1. On https://pypi.org/manage/account/publishing/, add a "Pending Trusted Publisher" for project agent-assembly with:
   • Owner: AI-agent-assembly
   • Repository: python-sdk
   • Workflow filename: release-python.yml
   • Environment: pypi
2. In this repo's Settings → Environments → create environment pypi (optionally with required reviewers).
3. After the first successful publish, PyPI converts the pending publisher to active.

Type of Change

• 🔧 Configuration

Breaking Changes

• No

New workflow file; nothing else touched. No effect on existing CI.

Related Issues

• Related JIRA ticket: AAASM-1217 (sub-task of Story AAASM-1202, Epic AAASM-1199)
• Depends on: AAASM-1215 ([AAASM-1215] 🔧 (build): Configure maturin build backend for platform wheel generation #53) for the [tool.maturin] config the workflow targets

Testing

• Manual testing performed

Validations:

• python -c "import yaml; yaml.safe_load(open('.github/workflows/release-python.yml'))" parses cleanly
• All 6 jobs verified by structural assertions (publish.needs covers all 5 build jobs; publish.if guards tag-push; publish.environment.name == 'pypi')
• Untrusted-input safety: no ${{ github.event.* }} interpolation in any run: script — repo name is sourced from workflow env: only

End-to-end exercise (matrix build + dry-run publish path) is the verification scope of AAASM-1219.

Checklist

• Code follows project style guidelines
• Self-review completed
• Comments added for complex logic
• Documentation updated if needed
• All tests passing

Commits (this PR's scope only — AAASM-1217)

1. ✨ (ci): Add release-python.yml skeleton with triggers and permissions
2. ✨ (ci): Add build-sdist job for pure-Python source distribution
3. ✨ (ci): Add manylinux_x86_64 wheel build job (PyO3/maturin-action)
4. ✨ (ci): Add manylinux_aarch64 wheel build job
5. ✨ (ci): Add macosx_arm64 wheel build job
6. ✨ (ci): Add macosx_x86_64 wheel build job
7. ✨ (ci): Add PyPI Trusted Publisher publish job gated on all build jobs