Validate the release tag and smoke-test the wheel without extras

[bagowix]

Problem

Two release risks are not covered by the current CI:

1. The release workflow accepts any v* tag without checking that it matches the package version in interlock/version.py.
2. The regular test suite runs from the source tree with all development dependencies and optional extras installed. An accidental import of an optional dependency from the core could therefore pass CI but make a plain pip install interlock-cb unusable.

For example, importing a Redis integration from interlock/__init__.py would work in the development environment, where redis is installed, but fail for users who install the core package only.

Proposed change

Add two small, independent checks:

• a packaging smoke job in regular PR CI that builds the wheel, installs it without dependencies in a clean Python 3.11 environment, and imports the public package;
• a release guard that verifies the pushed tag is exactly v{interlock.__version__} before publishing.

Acceptance criteria

• PR CI builds the wheel and installs it into a clean Python 3.11 environment without optional extras or development dependencies.
• The smoke test successfully imports interlock and verifies interlock.__version__.
• The release workflow fails before the publish job when the tag and package version differ.
• Existing build-once/artifact reuse, trusted publishing, and least-privilege permissions remain unchanged.
• The distributed core remains dependency-free.

Non-goals

• Automating changelog policy.
• Adding a separate release checklist.
• Duplicating metadata validation already performed by the build and PyPI upload tooling.

[bagowix]

Two additions to the packaging smoke job while it is being written, both cheap and both catching failures that only show up after publication:

• Assert py.typed survives the wheel. The package ships interlock/py.typed and advertises Typing :: Typed, but nothing verifies the marker is actually inside the built artefact. If a future build-target change drops it, mypy and pyright silently stop seeing any types for downstream users, and CI here stays green because it type-checks the source tree. In the clean environment:

  import importlib.resources as r
  assert (r.files("interlock") / "py.typed").is_file()

  The same check should walk interlock.integrations — a missing subpackage in the wheel is the other half of this failure mode, and the import smoke test only covers what it imports.

• Add twine check dist/* and check-wheel-contents dist/*.whl. Metadata rendering (the long description PyPI shows) and wheel layout problems — stray top-level files, missing or duplicated packages — are exactly the class of defect that is unfixable after upload, since a version number cannot be reused.

Neither changes the scope of this issue; both live in the same job.