ci: shield-swap-sdk release job, macos-15-intel runners, PyPI trusted publishing

[iamalwaysuncomfortable]

What

Release-pipeline changes cherry-picked from feat/shield-swap-sdk (everything before these landed in #49's squash), plus the switch to PyPI trusted publishing:

1. build-shield-swap job — builds the pure-Python shield-swap-sdk universal wheel + sdist, installs the release's own aleo-sdk wheel (linux-x86_64 artifact) and runs the hermetic suite against it, smoke-tests the installed wheel away from the source tree, and uploads as shield-swap-wheels-universal (matches the release artifact globs). Also adds shield-swap-sdk/** to the workflow path filters, giving the package CI coverage.
2. macos-13 → macos-15-intel — GitHub retired the macOS 13 image on 2025-12-04, so both macos-x86_64 jobs queued forever (no runner ever picked them up). macos-15-intel is GitHub's designated Intel migration path (supported until Fall 2027).
3. Trusted publishing (OIDC), one release job per package — replaces the token-based maturin upload with pypa/gh-action-pypi-publish under id-token: write. No PYPI_API_TOKEN secret is needed or used. Pending publishers must be unique per (repo, workflow, environment), so each package publishes from its own job/environment, and releases run strictly in order:

Job	Package	Environment	Artifacts
release-abi	aleo-contract-abi-generator	pypi-abi	abi-wheels-*
release-sdk	aleo-sdk	pypi	wheels-*
release-shield-swap	shield-swap-sdk	pypi-shield-swap	shield-swap-wheels-*

release-sdk needs release-abi; release-shield-swap needs release-sdk (it declares aleo-sdk>=0.2); all three gate on every build job. skip-existing: true keeps partial-failure re-runs safe.

Prerequisites already configured

Three pending publishers are registered on PyPI matching the table above (owner ProvableHQ, repo python-sdk, workflow sdk-wheels.yml). The GitHub environments auto-create on first use.

Release flow after merge

git tag v0.2.0 && git push origin v0.2.0

The tag run builds everything, then publishes abi → sdk → shield-swap. This PR's own CI run doubles as the first live validation of the macos-15-intel runners.