[DevOps]: Automated GitHub Release workflow on version tags

[shauryagangrade]

Problem

Releases are manual today (no release workflow). Tagging a version should
build and publish artifacts and produce a changelog-backed release.

Proposed approach

• On v* tag push: uv build, run the audit/import checks, and create a
  GitHub Release with notes pulled from CHANGELOG.md, attaching sdist+wheel.
• Keep pip-audit gating so a vulnerable dependency blocks the release.
• Optionally add a publish step (TestPyPI/PyPI) behind a secret.

Where to look

• .github/workflows/ci.yml build job (:70-102) to reuse.
• CHANGELOG.md structure.

Acceptance criteria

• Tagging v0.3.0 produces a release with artifacts and notes.
• Version consistency check passes as part of the workflow.

Difficulty

Medium.