PyPI packaging: trusted-publishing workflow + release scaffolding

[plancherb1]

Implements the ROADMAP's PyPI item:

• publish.yml: build sdist+wheel, twine check --strict, wheel smoke test (CLI + import + plugin registration), then OIDC trusted publishing — TestPyPI on manual dispatch, PyPI on GitHub release. No tokens stored.
• RELEASING.md: one-time trusted-publisher setup (web UI) + per-release steps.
• CHANGELOG.md: 0.1.0 (unreleased).
• pyproject.toml: classifiers (license, py3.11-3.13, Framework::Pytest, beta), project.urls.
• README/CLAUDE.md/ROADMAP.md: PyPI install path + release discipline.

Validated locally: build + twine check --strict PASS; wheel installed in a fresh venv — gpu-proof --help, import, and pytest option registration all work; 60/60 tests; mkdocs --strict clean. PyPI name is unclaimed (404).

After merge (repo-owner web UI, ~5 min): add pending trusted publishers on pypi.org/test.pypi.org and create the pypi/testpypi GitHub environments per RELEASING.md, then dispatch the TestPyPI lane as the dry run and cut v0.1.0.

🤖 Generated with Claude Code