release: prepare PyPI Trusted Publishing

[hippoley]

Prepare CounterProof for a low-friction pip install counterproof release without storing a long-lived PyPI token.

This adds:

• a release-only GitHub Actions workflow using PyPI Trusted Publishing / OIDC;
• tag ↔ pyproject.toml version matching before publish;
• build + twine check + clean-wheel CLI smoke test;
• a dedicated pypi GitHub environment boundary for the publish job;
• a one-time setup / release checklist;
• public package metadata aligned with the current CounterProof positioning.

This does not claim that counterproof is already published on PyPI. The first publish still requires the PyPI pending-publisher configuration documented in docs/RELEASING.md.