build: migrate releases to Release Please

[krowvin]

Replaces manually tagged releases and automatic TestPyPI uploads with the Release Please flow used by cwms-cli. Merging normal changes prepares a version/changelog PR; merging that PR creates the tag and GitHub release, tests and builds that exact tag, publishes to PyPI, and uploads signed distributions.

The advisory title reminder supports scopes and breaking changes, corrects the copyable examples from cwms-cli, and updates/removes only its own bot comment. CONTRIBUTING.md and README explain releases, squash commit subjects, TestPyPI retirement, setup, and recovery.

Validation:

• 95 mock/doctest tests passed; strict mypy passed for all 38 source files.
• Poetry check, wheel/sdist builds, and runtime version smoke check passed. Poetry reports existing legacy metadata deprecation warnings.
• Actionlint and the configured YAML pre-commit hook passed for both workflows.
• Local Release Please schema/strategy checks verified patch/minor/major Poetry updates and unprefixed tags; nine mocked reminder cases passed per repository.
• Whitespace checks passed. No package was published and no release was created during validation.
• Fresh Linux/Python 3.13 installation from the lockfile with dependency source builds disabled, followed by wheel/sdist builds, passed.
• SonarCloud, CodeQL, formatting, unit tests, and type checks pass on head 0524a59. The remote CDA matrix finished with 15 passing and 3 failing jobs; see the investigation below.

Integration failure investigation (run 34293478795):

• Failed combinations: Python 3.9 / CDA test / schema latest; Python 3.13 / CDA production / schema latest; Python 3.13 / CDA test / schema latest.
• Each job passes 78 tests and fails test_store_multi_timeseries_chunks_df and the subsequent test_get_multi_timeseries_chunk_df.
• Concurrent POSTs for Raw-Multi-2 fail with HTTP 404 and ORA-20998: ERROR: ORA-06512: at "CWMS_20.CWMS_TS", line 2459. The readback is incomplete: 4608, 576, or 1344 rows instead of 5952, depending on the job. The later read test fails because it uses those partially written series.
• store_multi_timeseries_df catches the inner chunk-storage exception and only prints it, so the test reaches its row-count assertion rather than stopping at the write failure. That behavior predates this PR.
• The affected Python source, tests, lockfile, Compose configuration, and CDA integration workflow are unchanged from base 4569028. All production/test-schema combinations passed. This points to a latest-dev backend interaction during concurrent creation/writes, not Release Please; the precise underlying database error is not exposed by the response, and the retained backend log tail does not establish it. No tests were disabled or retries added to hide the failure.

Maintainer setup: retain the existing PyPI trusted publisher for pypi-deploy.yml / environment release, allow default-branch deployments if the environment restricts branches, and allow Actions to create PRs. I could not read the repository Actions permission setting (403). The docs explain how to trigger missing release-PR checks when using GITHUB_TOKEN. The new release workflow and title reminder require merging before they can be exercised on the default branch.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[msweier]

Looks good, the AI found some a few issues, but this one I think is worth noting (not a blocker though since we are telling the workflow what to do anyway):

The title-check workflow has more access than it needs. It only needs to read pull requests and post comments. Consider reducing its pull-request access to read-only and lock the referenced action to a specific version.

[krowvin]

The title workflow has more permission so that it can remove the comment once the fix to the title is applied. But it maybe failing to do that?

If we feel leaving the comment is sufficient we could remove that permission.

[msweier]

The title workflow has more permission so that it can remove the comment once the fix to the title is applied. But it maybe failing to do that?

Oh maybe? I'm fine w/ it if you are.