ci: install and verify exact Python release artifacts

[imran-siddique]

Summary

Gate PyPI publication on independently installing and exercising both artifacts that will be uploaded: the wheel and source distribution.

For each artifact, the publish job creates a clean virtual environment, installs the artifact with its declared CLI extra, runs a standalone smoke test outside the checkout, and invokes the packaged manifest entry point. Tag-triggered releases also require the python-v* tag version to match package metadata.

Root cause

The existing workflow ran twine check, which validates distribution metadata but does not prove that an artifact installs, imports from the installed location, exposes the expected version/API, or can complete a cryptographic operation. Tests against checkout source cannot catch packaging omissions or stale build contents.

Validation

• Built the 0.11.0 wheel and sdist locally
• Installed each exact artifact into a separate clean virtual environment
• Verified metadata version and import provenance for both
• Completed a public Ed25519 sign/verify roundtrip for both
• Invoked the packaged CLI from both environments
• Full suite: 848 passed, 4 skipped
• mypy and Ruff: clean
• git diff --check: clean

Documentation

• Documented the release artifact gate in CONTRIBUTING
• Added an Unreleased security changelog entry