Publish releases from GitHub Actions with PyPI provenance - #1802

Summary

PyPI only accepts PEP 740 attestations (provenance) on files uploaded by a Trusted Publisher running in CI. A local upload with an API token can't carry them, so this moves the upload into GitHub Actions.

• New .github/workflows/publish.yml, started by hand on a release tag:
  • The build job checks the tag with scripts/validate_tag.py, runs uv build, and uploads
    dist/ as an artifact. It has read-only permissions and no uv cache.
  • The publish job downloads dist/ and uploads it with pypa/gh-action-pypi-publish, which
    signs and uploads the attestations by default. It runs in the pypi or testpypi environment,
    and it's the only job that can request an OIDC token.
  • Every action is pinned to a commit SHA, since this is the workflow that can publish.
• make publish / make publish-test still check the tag first. They then confirm the tag on
  origin matches the local one, start the workflow with gh workflow run, and follow it with
  gh run watch --exit-status. The release checklist doesn't change.
• uv-publish is removed from the dev dependency group because nothing uses it anymore.
• .github/CONTRIBUTING.md documents the new flow and the one-time setup.

Already configured outside this PR

• Trusted Publishers on PyPI and TestPyPI for publish.yml with environments pypi / testpypi
• GitHub environments pypi and testpypi:
  • deployments only from tags matching *.*.*
  • cmd2-admins required as reviewers, with administrator bypass turned off
• Repository ruleset "Release tags": only cmd2-admins can create, move, or delete *.*.* tags

Testing

• make check, make test, and make docs-test pass
• zizmor reports no findings for publish.yml
• I ran both make targets with a fake gh to check the normal run, a missing run URL, a failed
  run, and a tag that isn't on origin
• The workflow itself can only run after this merges. The first real check is make publish-test
  on the next release tag.

Notes

• 4.4.0 can't get provenance after the fact: PyPI only accepts attestations as part of the
  original upload, and uploaded files can't be changed.
• The workflow has to be on main before the next release is tagged, because gh runs the copy
  of publish.yml inside the tagged commit.
• No CHANGELOG entry, since this only changes release tooling.