ci: add reproducible release packaging

[codeforester]

Summary

• Add the tracked uv lockfile and an executable clean package gate.
• Build and inspect both wheel and source distribution artifacts with Twine metadata checks.
• Add a guarded tag/manual release workflow with version verification and artifact upload.
• Keep Base's guarded release publisher as the GitHub Release boundary.

Validation

• ./tests/validate.sh
• UV_CACHE_DIR=/private/tmp/base-cli-demo-issue7-uv uv run --extra dev ./tests/package.sh
• UV_CACHE_DIR=/private/tmp/base-cli-demo-issue7-uv uv run --extra dev pytest -q (5 passed)
• UV_CACHE_DIR=/private/tmp/base-cli-demo-issue7-uv uv run --with ruff ruff check src tests
• UV_CACHE_DIR=/private/tmp/base-cli-demo-issue7-uv uv run --with ruff ruff format --check src tests
• bash -n tests/package.sh
• Release workflow YAML parsed with Ruby YAML loader

Fixes #7