Merge release into ci.yml: tag pushes run check then publish (needs: check). Remove standalone python-publish so PyPI never ships on red CI. Retag (delete+push v*) still retriggers the pipeline.
PDM-based CI on 3.14 (ruff, basedpyright, pytest); tag publish without git-cliff.