Tag-driven PyPI release workflow (OIDC, no tokens)

[joshlin111]

Summary

Adds .github/workflows/release.yml — a 4-job pipeline triggered by v* tag pushes:

1. Offline tests (gate) — reruns make test on the tagged commit so a stale or off-main tag can't ship a broken release.
2. Build sdist + wheel — fails fast if the tag name doesn't match pyproject.toml's version (catches "tagged v3.4.1 but forgot to bump").
3. Publish to PyPI — uses pypa/gh-action-pypi-publish with OIDC trusted publishing. No long-lived PyPI token in repo secrets. Bound to a pypi GitHub Environment so a Required reviewer can gate every release.
4. Create GitHub Release — attaches the built sdist + wheel and auto-generates release notes from the commits since the previous tag.

One-time setup required before the first release tag works

This PR is safe to merge as-is — the workflow does nothing until a v* tag is pushed. But the first tag will fail unless these are configured:

On PyPI

Go to https://pypi.org/manage/project/apexomni/settings/publishing/ → Add a new trusted publisher:

Field	Value
Owner	ApeX-Protocol
Repository name	apexpro-openapi
Workflow filename	release.yml
Environment name	pypi

(If the PyPI project page isn't accessible because no maintainer here owns it on PyPI, that's a blocker — sort the ownership first.)

On GitHub

Settings → Environments → New environment named exactly pypi:

• (Recommended) Required reviewers — add one or two people who must approve each release before the PyPI upload step proceeds.
• (Recommended) Deployment branches and tags — restrict to main so a tag pushed from a feature branch can't trigger a release.

How to cut a release after setup is done

# 1. Bump version in pyproject.toml on a PR, merge to main.
# 2. From the merged main commit:
git checkout main && git pull
git tag v3.4.1
git push origin v3.4.1

The PyPI URL, the GitHub Release page, and a cached wheel artifact all appear within ~5 minutes.

Test plan

• Tag/version match check verified locally with both passing (v3.4.0 vs version = \"3.4.0\") and failing (v9.9.9) cases.
• make test green via pre-push hook.
• CI pass on this PR (workflow only parses on PRs — actual end-to-end will be verified by the first real tag push after PyPI + Environment are configured).