Require PyPI release tags to descend from main

[sderev]

Author: AI

What changed:

• Add the shared release-history checkout and ancestry guard to the PyPI workflow.
• Require stable release tags to resolve to commits reachable from origin/main before uv publish.
• Preserve prerelease and non-stable tag behavior.

Why:

• Prevent an off-main tag from reaching PyPI if a release is published too early.

How to test:

• gate; uv lock --check; uv build
• Parse the workflow as YAML.
• No live release was created.

Risk/comp notes:

• The guard runs only for stable tags; prereleases still skip PyPI publication.
• Lightweight and annotated tags are both resolved to commits.

Changelog fragment: no; this changes release infrastructure only.