Make CI and releases safe by default

[rczobor]

Why

The release workflow currently publishes Docker and PyPI artifacts on every branch push, before a tag or version assertion. The test setup also relies on mutable service images, has unbounded readiness waits, and declares Python versions that the current dependency set cannot install on.

What changed

• add a reusable CI workflow for pull requests, branch pushes, and release gating
• restrict publishing to tags, require the tag to match the package version, and grant least-privilege workflow permissions
• test the actual supported range (Python 3.11 and the production Python 3.14 runtime)
• align package metadata with the current pydicom and orthanc-api-client runtime requirements
• add Windows timezone data only where it is needed
• pin disposable Orthanc/auth test stacks to known versions
• bound authorization-service startup and make replicator Docker checks portable and race-free
• update the release actions to their maintained major versions

Local checks

• Python 3.11 compatibility image: 35 unit tests plus sdist/wheel build
• Python 3.14 production image build
• Linux/Python 3.14 HL7 suite: 36 tests
• three-Orthanc Docker suite: 40 tests in 615.5s, including high-volume transfers
• authorization Docker suite: 3 tests
• replicator Docker suite: 4 tests, including broker loss/recovery
• isolated local sdist/wheel build
• all three Compose files parsed successfully
• git diff --check

No production service or mp-docker host was contacted or changed.