[codex] migrate CI from CircleCI to GitHub Actions

[streeter]

Summary

• Replace CircleCI with a GitHub Actions workflow for Python 3.11 linting and tests.
• Remove Python 2 package metadata and declare Python 3-only support.
• Move tag-based PyPI publishing to GitHub Actions and fail before publishing when PYPI_PASSWORD is not configured.
• Replace the CircleCI README badge with a GitHub Actions badge.

Notes

The workflow also checks for AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY before fetching the private S3 test fixtures, so missing fixture credentials fail clearly.

Validation

• ruby -e "require 'yaml'; YAML.load_file('.github/workflows/ci.yml')"
• python setup.py --name
• Clean worktree: python -m flake8
• Clean worktree: python setup.py sdist bdist_wheel

python -m pytest -q reached the test suite in a clean worktree with copied local fixtures, but test_parse_receipt failed because the local copied receipt fixture contains an expired WWDR certificate. If the S3 fixture is the same file, the new GitHub Actions workflow will fail there too.