docs(release): document PyPI Pending Publisher constraint, MFA helper, and check all release tags

[gspencergoog]

Summary

Documents first-time setup for new PyPI packages, the single Pending Publisher limit, and MFA helper commands in the Python release guide and skill. Also expands the tag check in .github/workflows/release-pypi.yml now that a2ui-a2a and a2ui-adk have initial release tags.

Changes

• Replaces the pre-release note for a2ui-a2a and a2ui-adk in docs/contributing/release.md and .agents/skills/a2ui-release-python/SKILL.md with general instructions for releasing a new PyPI package for the first time.
• Documents the two one-time prerequisites for a new PyPI package: adding it to the OSS Exit Gate allowlist, and registering a Pending Publisher on https://pypi.org/manage/account/publishing/.
• Explains that PyPI indexes pending publishers for Google Cloud uniquely by (email, sub). Therefore, a2ui-py@oss-exit-gate-prod.iam.gserviceaccount.com can have only one Pending Publisher at a time, and new packages must be published sequentially.
• Adds the oathtool --totp -b "YOUR_MFA_SETUP_KEY" command for generating the 6-digit MFA code and points to https://groups.google.com/a/google.com/g/a2ui-pypi-publish-bot for unrecognized-device verification emails.
• Updates the Confirm release tags are visible step in .github/workflows/release-pypi.yml to check reachable tags for 'python/a2ui-a2a/v*' and 'python/a2ui-adk/v*' alongside 'python/a2ui-core/v*' and 'python/a2ui-agent-sdk/v*'.

Impact & Risks

• No runtime or library behavior changes.
• Future runs of .github/workflows/release-pypi.yml check that python/a2ui-a2a/v* and python/a2ui-adk/v* tags are present in the checkout before building distributions.

Testing

• Check locally that all four tag globs resolve from main:

  for glob in 'python/a2ui-core/v*' 'python/a2ui-agent-sdk/v*' 'python/a2ui-a2a/v*' 'python/a2ui-adk/v*'; do
    git describe --tags --match "$glob"
  done

• Checked formatting with npx prettier --check and CI checks on the pull request (python-ci, format-check, static-checks, and zizmor).

[nan-yu]

Thanks for updating the release doc for new packages. Since you're on this topic, would you mind updating the comment in the Confirm release tags are visible step in .github/workflows/release-pypi.yml?

Since python/a2ui-a2a/v0.1.0 and python/a2ui-adk/v0.1.0 are now tagged, that loop could optionally be expanded to include 'python/a2ui-a2a/v*' and 'python/a2ui-adk/v*'.