[amannocci]

Summary

Replaces the local poe release and tag-triggered publish with two manually dispatched workflows:

1. pre-release.yml (input: X.Y.Z) stamps the changelog, sets the version and opens a PR from feat/pre-release-vX.Y.Z.
2. release.yml (input: next version, X.Y.Z-dev) runs CI, tags the project version, publishes to PyPI through trusted publishing, then opens a PR from feat/post-release-vX.Y.Z-dev setting the next version.

Changes

• scripts/release.py now has pre, run and post tasks, exposed as release:pre, release and release:post.
• release refuses a non-release version, so a .dev0 build can't be published if the pre-release PR isn't merged. Failures exit non-zero, which stops the publish job.
• ci.yml can be called with workflow_call, and its ubuntu/3.12 job uploads the dist artifact that gets published.
• Both release workflows only run when dispatched from main.
• All workflows use the techcode-io/github-actions/setup-uv proxy, which pins uv to 0.13.5 by default.

Testing

• Ran all three tasks in a throwaway clone with a local bare remote and a fake gh. Each step worked and uv sync --locked passed after each version change. Bad input, a dev version and an existing tag all failed as intended.
• uv run poe ci passes locally (231 tests).
• The workflows themselves haven't run on GitHub, so the first real release is the first test of the OIDC publish and of opening PRs.

Before the first release

• Add a pending trusted publisher on PyPI for techcode-io/proclet, workflow release.yml, environment pypi, if there isn't one yet.
• Enable "Allow GitHub Actions to create and approve pull requests" in the repo's Actions settings.
• PRs opened with GITHUB_TOKEN don't trigger ci.yml. If main requires status checks, the release PRs won't get them without a push to the branch or a PAT/App token. release.yml still runs CI before publishing.