Automate semantic GitHub and PyPI releases

[nicococo]

What Changed

• add a manually dispatched Deploy Release workflow with patch, minor, and major choices
• calculate stable versions from Git tags and support explicit recovery through resume_tag
• gate tag creation and PyPI publication behind a protected pypi environment
• replace the long-lived PyPI token workflow with OIDC Trusted Publishing and attestations
• build wheel/sdist once, validate metadata, publish, install the exact version on Python 3.11/3.12, and smoke-test CLI/TUI imports
• create a GitHub Release with generated notes, distributions, and SHA-256 checksums
• make docs deployment reusable and release-tag aware, including website, pdoc, and wiki
• show the latest release link in the website header
• pin every security-sensitive action touched by the release path to an immutable commit SHA
• document release setup, operation, and partial-failure recovery

External Setup Required Before First Release

1. Create a protected GitHub environment named pypi and choose required reviewers.
2. Register the PyPI Trusted Publisher for BusySloths/mlox, workflow deploy-release.yml, environment pypi.
3. Remove PYPI_API_TOKEN after the first successful trusted publication.

See docs/RELEASING.md for exact instructions.

Testing

• go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/deploy-release.yml .github/workflows/deploy-docs.yml
• python -m pytest tests/unit/test_release_version.py tests/unit/test_cli.py -q -p no:sugar --tb=short — 29 passed
• python -m flake8 scripts/next_release_version.py tests/unit/test_release_version.py
• python scripts/check_docs.py
• npm run build with release tag/link environment variables — 0 diagnostics
• clean temporary clone tagged v9.99.99: wheel and sdist built, strict twine check passed, wheel metadata reported Version: 9.99.99

User Impact

Maintainers receive a guarded one-click semantic release path. Users get an attested PyPI package, exact-version verification, generated GitHub release notes and assets, release-tagged documentation, and a website link to the latest release.

Checks

• Updated docs/DOCTRINE.md for release-pipeline status
• Documented one-time repository/PyPI configuration
• No service/server catalog regeneration required
• No Streamlit changes