Publish Python SDK with PyPI trusted publishing

[edo-chan]

Summary

• bump swig-developer-sdk to 0.7.0
• add the trusted-publisher workflow PyPI is configured to accept: .github/workflows/publish-python.yml
• build, lint, type-check, and test without OIDC permissions
• publish from a separate least-privilege job using pypa/gh-action-pypi-publish@release/v1
• require release tags to match the locked package version and point to a commit on main
• create a GitHub release with the wheel and source distribution after PyPI succeeds

After merge, publishing is triggered by the swig-developer-sdk@0.7.0 tag. No PyPI token or repository secret is used.

Validation

• actionlint .github/workflows/publish-python.yml
• bunx prettier --check .github/workflows/publish-python.yml
• uv version --short --locked (0.7.0)
• uv sync --frozen --all-groups
• uv run --frozen ruff format --check src tests scripts
• uv run --frozen ruff check src tests scripts
• uv run --frozen mypy src scripts
• uv run --frozen pytest (21 passed)
• uv build