Add human-gated release workflow and artifact verification

[Tim55667757]

Parent Feature: #41
Parent roadmap: #28

Scope

Build/test release artifacts before publication and require explicit approval for PyPI.

Acceptance criteria

• exact release commit/tag is recorded;
• sdist/wheel are built and installed in clean environments;
• hashes and metadata are verified;
• publication is human-gated;
• Trusted Publishing is evaluated/used if operationally appropriate;
• release does not publish source-tree accidents or stale artifacts.