v0.8.3 — automated, self-proving release pipeline

The release process now proves itself. Pushing a vX.Y.Z tag runs one ordered,
fail-closed pipeline — no manual gh release create, no way to ship a mislabelled
or untested artifact.

A v* tag triggers: tests (3.10–3.13, the same reusable matrix every push to main
runs) → guard (assert the tag equals forge.__version__; build the wheel and
install it into a clean venv; smoke-test forge --version/--help) → pypi (publish
the VETTED artifact via OIDC trusted publishing) → github-release (create the
Release, titled and noted from the release: commit body). Each stage gates the
next, so a red test, a tag≠version mismatch, or a broken wheel stops the run before
anything publishes; the Release is created last, so a Release existing means the
version is already on PyPI. This closes the exact gap behind the v0.7.6–v0.7.11
"version bumped but never released" drift.

All actions are pinned by immutable commit SHA (verified commits, not tag objects);
the publish is idempotent (skip-existing) so a re-pushed tag recovers a failed
release; jobs carry timeouts and least-privilege permissions. RELEASING.md
documents the one-push flow. tests/test_cli.py adds in-repo checks that the CLI
starts (--version/--help) and __version__ is clean semver — the coherence the
tag-gate depends on.

This release is itself the first cut driven through the new pipeline. Stdlib-only,
zero runtime deps.