[P1] V1-005: Python packaging + release automation (Trusted Publishing)

[mrnicholasbcarter-code]

Acceptance criteria

• Build wheel + sdist via hatch
• PyPI Trusted Publishing OIDC config in .github/workflows/pypi-publish.yml (id-token: write + environment: pypi)
• Attestations enabled
• One merged tag publication produces an immutable GH Release

Refs: evidence/V1_READINESS_AUDIT_2026-08-03.md