ci: adopt release-please for automated releases

[kw-datamasque]

Replaces the manual make release-* flow (which the main ruleset blocked from
pushing) with release-please:
releases are now driven by Conventional Commits.

What

• release-please.yml — on each merge to main, release-please keeps an open
  release PR that bumps pyproject.toml and regenerates CHANGELOG.md from commit
  messages. Merging that PR tags the commit, creates the GitHub Release, and publishes
  to PyPI. The publish job is gated on a release actually being cut
  (release_created == 'true'), so it runs in the same workflow run as the merge — no
  PAT and no "GITHUB_TOKEN doesn't trigger workflows" gotcha.
• Removed release.yml — the tag-triggered publisher is superseded; one route to PyPI.
• Removed make release-{patch,minor,major} + scripts/bump_version.py — dead under
  the ruleset, and now release-please's job.
• CONTRIBUTING — "Releasing" and "Commit messages" rewritten for the new flow.

Two one-time settings before publishing works (not in the diff)

• PyPI trusted publisher → point it at release-please.yml (keep environment pypi).
  Until then the publish step fails OIDC; everything before it (release PR, bump,
  changelog, tag, GitHub Release) still works.
• Repo → Settings → Actions → General → enable Allow GitHub Actions to create and
  approve pull requests, or release-please can't open its PR.

First run

Manifest is seeded at 1.3.0, so the first release PR will be v1.3.1 (from the fix:
in #13), with the changelog grouped by type.

Not in scope

Existing CHANGELOG.md entries keep their ### Added style; new sections will use
Conventional-Commit headings (### Bug Fixes, etc.). Left as-is rather than rewriting
past entries.