- .github/workflows/ci.yml — ruff + mypy + pytest on every push/PR,
  matrix py3.11 + py3.12.
- .github/workflows/publish.yml — fires on `v*` tag push (or manual
  workflow_dispatch with an existing tag). Verifies tag version
  matches pyproject.toml, re-runs the full gate, builds, then
  `uv publish`'s using UV_PUBLISH_TOKEN from the `default` env, and
  creates a GitHub Release with the dist artifacts attached.

Also clean up mypy noise: suppress one Patchright **dict[str, object]
new_context unpack with a targeted type-ignore so CI mypy passes
cleanly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>