build(sdist): drop .github/workflows so CI-only commits stop moving the sdist hash

[makegov-mark]

Problem

The sdist whitelist included /.github/workflows, so any CI-only commit changed the sdist for an otherwise-unchanged package.

That defeats the --check-url flag added in #57. uv publish --check-url compares each freshly-built file against the index and errors on a mismatch — which is correct behavior, since a same-name-different-bytes artifact is exactly what you want a publisher to refuse. But it means a version already on PyPI stops being recognizable as already-published the moment CI changes.

The worked example

v1.5.0, which is why this surfaced:

1. Published by hand from the release commit 0b1e94c.
2. ci(publish): make the PyPI upload idempotent so a Release cannot go red over a duplicate #57 added --check-url to publish.yml — a workflow-only change that nonetheless altered the sdist, because the workflow file ships inside it.
3. The Release's publish run skipped the wheel correctly (already exists, skipping) and then failed on the sdist:

   error: Local file and index file do not match for tango_python-1.5.0.tar.gz.
   Local: sha256=22043b72…  Remote: sha256=13694bb0…
   

No tag target could have avoided it. A release event takes both the workflow and the checkout from the tagged commit (confirmed on the failed run: headSha=83c3003, event=release). Tagging the pre-fix commit runs a publish without --check-url and fails on the duplicate instead. The failure was locked in the moment 1.5.0 was published from a tree whose publish.yml predated the fix.

Fix

Remove /.github/workflows from the sdist whitelist, with a comment at the whitelist explaining the omission so it does not get "helpfully" restored later.

CI definitions are not buildable-from-source content — nobody runs this project's GitHub Actions from a PyPI tarball — so the entry bought nothing and cost hash stability.

Verification

• Stability, measured: built the sdist, appended a line to .github/workflows/lint.yml, rebuilt. Both hash to a53243c1…. Before this change the hash moved.
• Completeness: uv build still builds the wheel from the sdist, so the whitelist has not lost anything the build needs. Top level is tango tests docs scripts README.md LICENSE CHANGELOG.md pyproject.toml.
• Reproducibility (bonus finding): the sdist build is deterministic across machines — rebuilding v1.5.0 at 0b1e94c locally reproduced PyPI's remote hash 13694bb0… exactly. That is what made this diagnosable rather than guesswork, and it is worth preserving.
• 345 tests pass.

Scope

This does not retroactively fix v1.5.0's red publish run — nothing can, since its sdist is already on PyPI. It makes 1.6.0 onward clean, and makes --check-url reliable rather than conditional on nobody having touched CI.