Lint/build CI + GitHub Release → PyPI publish workflow

[bluesentinelsec]

Summary

Third polishing slice (after #1 opt-outs/tests, #2 package split):

• Version: src/cppboot/_version.py is the single source (setuptools dynamic version)
• Quality: ruff check/format + mypy (strict) in CI; fixed lint/type issues
• Build: CI builds sdist/wheel and runs twine check
• Publish (.github/workflows/publish.yml):
  • Triggers on GitHub Release published (tag vX.Y.Z must match package version)
  • Builds distributions, then uploads to PyPI via Trusted Publishing (OIDC)
  • Manual workflow_dispatch defaults to TestPyPI
  • Does not publish anything until you create a release / run the workflow

Release flow (when you are ready later)

1. Bump _version.py + CHANGELOG → merge to main
2. gh release create v0.1.0 (or UI)
3. Publish workflow verifies tag == version → builds → PyPI

One-time: configure PyPI Trusted Publisher + GitHub Environments pypi / testpypi (documented in README).

Test plan

• pytest 56 passed
• ruff check / ruff format --check clean
• mypy clean
• python -m build && twine check dist/* passed
• CI green on this PR (lint + build + matrix tests)
• Do not create a GitHub Release or run publish against real PyPI yet