Add PyPI release workflow

[JWhitleyWork]

Summary

• Add a CD workflow for PyPI publication via Trusted Publishing/OIDC
• Gate publication so only tags matching ^[0-9]+\.[0-9]+\.[0-9]+$ build and publish
• Verify the pushed tag matches project.version before building
• Document PyPI release setup and release tag format in the README

Verification

• ruff format .
• ruff check .
• mypy
• pytest
• python -m build
• python -m twine check dist/*
• Verified wheel contains plugin.yaml, bundled skill, and py.typed
• Verified release regex accepts 0.1.0 / 10.20.30 and rejects v0.1.0, 0.1, 0.1.0rc1
• Confirmed hermes-github-app-plugin is not currently present on PyPI via pip index versions