The workflow only listened to release: [published]. Adding push: tags: v*
ensures cz bump (which creates a tag but not a GitHub Release) also
triggers the PyPI publish job.