ci: publish strix-agent to PyPI on release tags

[ousamabenyounes]

Summary

• Add a tag-only publish-pypi job to the release workflow using PyPI Trusted Publishing (id-token: write, environment pypi).
• Build the Python sdist/wheel with uv build and publish via the pinned pypa/gh-action-pypi-publish action.
• Fail the publish job early if the release tag version does not match [project].version in pyproject.toml.

Fixes #883

Validation

This is a declarative workflow change, so there is no executable product RED/GREEN to invent. The pre-change workflow had no job that built Python distributions or published to PyPI; it only built standalone binaries and created a GitHub Release.

$ uv build
Building source distribution...
Building wheel from source distribution...
Successfully built dist/strix_agent-1.4.0.tar.gz
Successfully built dist/strix_agent-1.4.0-py3-none-any.whl

$ uv run python - <<'PY'
from pathlib import Path
import yaml
path = Path('.github/workflows/build-release.yml')
with path.open(encoding='utf-8') as fh:
    doc = yaml.safe_load(fh)
assert 'publish-pypi' in doc['jobs']
assert doc['jobs']['publish-pypi']['permissions']['id-token'] == 'write'
print('workflow yaml parsed')
PY
workflow yaml parsed

No build artifacts are committed.

[greptile-apps]

Greptile Summary

Adds tag-only PyPI publishing to the release workflow.

• Verifies that the release tag matches the Python package version.
• Builds the source distribution and wheel with uv.
• Publishes through PyPI Trusted Publishing with pinned actions and scoped permissions.

Confidence Score: 5/5

The PR appears safe to merge, with the publishing job appropriately limited to release tags and guarded by package-version validation.

The workflow uses a fresh checkout, pinned actions, scoped OIDC permissions, matching repository tag conventions, and the expected uv build artifacts and PyPI publishing defaults.

Important Files Changed

Filename	Overview
.github/workflows/build-release.yml	Adds a correctly gated and permission-scoped PyPI publishing job with version validation; no actionable defects identified.

_{Reviews (1): Last reviewed commit: "ci: publish package to PyPI on release t..." | Re-trigger Greptile}