Tag-triggered publish now also opens a GitHub Release for the same tag,
attaches the three wheel/sdist pairs as release assets, and uses GitHub's
auto-generated release notes for the changelog. Combined with the
existing PyPI immutability + sigstore attestations, this gives every
released version a single, verifiable provenance trail.

Bump to 0.5.7 to exercise the new release step end to end.