* docs: add pypi-publish-readiness spec (requirements, design, test-design, tasks)

Spec for PyPI publication readiness: package metadata fixes (py.typed,
version single source, CHANGELOG, classifiers), publish workflow
(tag push trigger, Trusted Publisher OIDC), and wheel integrity
verification (CI + local). Codex-reviewed design with 11 implementation tasks.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat: add PyPI publish readiness (version, metadata, CI/CD, verification)

- Version single-source-of-truth via importlib.metadata with fallback
- PEP 561 py.typed marker and scientific classifiers
- CHANGELOG.md in Keep a Changelog format
- publish.yml: tag-triggered PyPI publish with Trusted Publisher (OIDC),
  all actions SHA-pinned, build/publish job separation
- ci.yml: build-check job for wheel integrity on every PR
- scripts/verify_wheel.py: wheel content verification (frontend assets + py.typed)
- scripts/check_tag_version.py: git tag ↔ pyproject.toml version consistency
- poe tasks: verify-wheel, check-tag-version, release-dry-run
- sdist artifacts config to fix static files in sdist-based wheel builds
- 18 new tests (725 total), team-review S-01 fix (command injection prevention)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: ensure module reload in version fallback tests via try/finally

Assertion failure in TestVersionFallback left __version__ stuck at
"0.0.0+unknown", potentially polluting subsequent tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>