Add tag-triggered PyPI publish workflow via Trusted Publishing

[BaliDataMan]

Summary

• New workflow (.github/workflows/publish.yml), separate from ci.yml, triggered only on push of a v* tag.
• Uses PyPI Trusted Publishing (OIDC) — no PYPI_API_TOKEN secret required, but the trusted publisher must be configured on pypi.org first (see below).
• Guards against publishing a version that doesn't match the tag, so a version bump in pyproject.toml is required before every release.

Required manual setup before this can actually publish

On https://pypi.org/manage/project/ragmesh/settings/publishing/, add a trusted publisher:

• Repository: BaliDataMan/ragmesh
• Workflow filename: publish.yml
• Environment name: pypi (matches this workflow's environment: pypi)

Also create a "pypi" environment under repo Settings > Environments (optional, but recommended as an approval gate before publish).

Test plan

• uv build verified locally — produces both the wheel and sdist correctly
• Not yet tested end-to-end (needs the PyPI trusted-publisher setup above, then a real tag push to trigger it)