Publish to PyPI on a published GitHub Release, not a tag push #66

Standardized across the repositories by the ecosystem lead: a version can't be re-uploaded to PyPI, so publishing must be deliberate. A v* tag trigger fires on a stray git push --tags; a GitHub Release records the tag and notes together. Done when publish-pypi.yml triggers on release: published, checks github.event.release.tag_name against pyproject, the pypi environment's v* tag policy is kept, and AGENTS/SPEC/PROJECT say so.