Document publish operations

[cbusillo]

Summary

• document that TestPyPI publishing should not require manual GitHub environment approval
• document that production PyPI publishing should keep maintainer approval
• add exact trusted publisher values and the expected TestPyPI OIDC claims
• add release workflow memory to AGENTS.md

Verification

• git diff --check
• uv run pytest
• rm -rf dist && uv build
• uv run twine check dist/*

Notes

The failed TestPyPI publish showed invalid-publisher, meaning TestPyPI did not have a pending publisher matching the run claims.