Add a release workflow: publish to PyPI via trusted publishing

[fsecada01]

cf-ui has no release workflow. Publishing 0.2.0 today would mean building on a laptop and uploading by hand, which is exactly the path that ships a wheel nobody can reproduce.

component-framework got one in fsecada01/component-framework#48. cf-ui needs the matching workflow so both projects release the same way.

Approach

PyPI trusted publishing (OIDC) — no API token is created, stored, or rotated. The job mints a short-lived OIDC token that PyPI exchanges for an upload token scoped to this project alone. A leaked repo secret cannot be used to publish, because there is no secret.

The upload sits behind a pypi GitHub environment, so protection rules can require a review before anything reaches PyPI. Nothing in this repo needs a token today or ever.

Acceptance criteria

• .github/workflows/release.yml triggers on v* tags and workflow_dispatch
• Build job runs uv build and twine check dist/* — a malformed README or broken metadata fails before upload, because a bad upload can only be yanked, never replaced
• Build job asserts the tag matches pyproject.toml's version, so the wheel cannot be published under a name the tag does not describe
• Build job asserts the wheel actually contains the templates. cf-ui is nothing but templates, and they ship inside the package so hatchling picks them up automatically — a packaging change that quietly drops templates/ produces a wheel that installs fine and renders nothing
• Build job asserts the generated axis assets (cf_ui_axes.css, cf_ui_axes.json) are in the wheel
• Publish job is a separate job gated on environment: pypi, with permissions: id-token: write, using pypa/gh-action-pypi-publish@release/v1
• No PyPI API token anywhere in the workflow or repo secrets

Out of scope

Cutting the actual 0.2.0 tag. That waits on #42 and #43, and on component-framework publishing first — cf-ui's wheel metadata carries Requires-Dist: component-framework>=0.4 with no git source, so pip cannot resolve cf-ui until that name exists on PyPI.

Manual step this does not cover

A pending publisher must be registered on PyPI before the first upload — trusted publishing has no way to bootstrap itself for a project that does not exist yet. Owner fsecada01, repo component-framework-ui, workflow release.yml, environment pypi.