Trusted publisher (OIDC) to PyPI on tag push.
Security gates: 6 tests, pip-audit, grep checks for subprocess/http/credentials.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>