CI/CD: test matrix and automated PyPI publish

[kicka5h]

GitHub Actions workflows for continuous testing and automated releases.

Scope

• `ci.yml`: run `pytest` on push/PR to `main` across Python 3.10, 3.11, 3.12
• `publish.yml`: triggered by `v*` tags — test, build, publish to PyPI, create GitHub Release
• PyPI publish uses OIDC trusted publishing (no stored API token)
• GitHub Release automatically attaches `.whl` and `.tar.gz` artifacts

Acceptance criteria

• CI passes on all three Python versions
• Publish workflow runs end-to-end on a test tag
• PyPI trusted publisher configured (no `PYPI_TOKEN` secret needed)
• GitHub Release created with artifacts on tag push