Build wheel+sdist, twine check, clean-venv import smoke, then publish to
PyPI via OIDC Trusted Publishing (pypa/gh-action-pypi-publish) on push of a
v* tag or a published Release. No API token stored in the repo.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>