v0.1.0 ci: publish woolpack with Trusted Publishing

[minglong51]

Summary

Packaging

• Prepare the standalone woolpack 0.1.0 distribution with PyPI metadata, package-level usage documentation, and explicit MIT/CC0 licensing for bundled scaffold assets.

Release infrastructure

• Add a release-triggered, SHA-pinned Trusted Publishing workflow that validates the tag, commit ancestry, artifacts, metadata, and clean wheel/sdist installs before entering the protected pypi environment.
• Harden existing CI action pins and make wheel/sdist build-and-install smoke tests part of the Woolpack boundary.

Architecture documentation

• Update the HLD and LLD to describe the standalone distribution and release trust boundary.

Test Coverage

CHANGED SURFACES
├── pyproject.toml ── package metadata only [N/A]
├── README.md ─────── PyPI long description [N/A]
├── HLD / LLD ─────── documentation only [N/A]
└── release workflow ─ GitHub release → build/check wheel+sdist
                       └── pypi environment + OIDC → publish [CI smoke-gated]

COVERAGE: 0/0 new application paths (100% no-code fast path)
GAPS: 0

No tests were added or modified.

Pre-Landing Review

No issues found. The workflow, metadata, artifact contents, shell scripts, and immutable action pins were reviewed after the final OIDC wording fix.

Design Review

No frontend files changed — design review skipped.

Eval Results

No prompt-related files changed — evals skipped.

Scope Drift

Scope Check: CLEAN.

Plan Completion

No in-repository plan file detected. The approved release scope is complete; promotion work remains separate from this PR.

Verification Results

• Pytest: 242 passed, 1 skipped
• Ruff: all checks passed
• Pebble strict lint: 13 PASS, 0 WARN, 0 ERROR
• Denylist check passed
• Wheel and sdist built; Twine strict checks passed
• Clean wheel and sdist installs passed CLI scaffold, render, and strict-lint smoke tests
• Zizmor found no workflow findings after action pinning
• Synthetic woolpack-v0.1.0 validation passed; a mismatched tag was rejected

The repository has no root release-version convention; packages/woolpack/pyproject.toml remains Woolpack's 0.1.0 source of truth.