ci: publish via trusted publishers

[maartenbreddels]

Summary

• add GitHub Release-triggered publish jobs for PyPI and npm using trusted publishing / OIDC
• reuse the dist artifact produced by the build job, including wheel, sdist, and npm tgz
• run publish jobs in dry-run/check mode on PRs and pushes; real upload happens only for release: published
• validate release tag vs wheel version and guard against publishing an already-existing npm version

Closes #30

Local validation

• git diff --check
• Ruby YAML parse for .github/workflows/build.yml
• /tmp/bqplot-gl-build-venv/bin/python -m build
• /tmp/bqplot-gl-build-venv/bin/python -m twine check dist/*.whl dist/*.tar.gz
• PATH=/tmp/bqplot-gl-build-venv/bin:$PATH jlpm pack -o bqplot-gl.tgz
• npm view bqplot-gl@0.1.0 version

One-time setup before first real release

• Create PyPI trusted publisher for project bqplot-gl, workflow build.yml, environment release-pypi.
• Create npm trusted publisher for package bqplot-gl, workflow build.yml, environment release-npm.
• Create GitHub environments release-pypi and release-npm in this repo.