ci: tag-triggered publishing + automated db migrations

release.yml: axis-server-v* / axis-init-v* / python-sdk-v* tags publish
their package from CI secrets (NPM_TOKEN, PYPI_API_TOKEN) — with a
tag-vs-manifest version assertion so a tag can never ship a version the
repo doesn't declare, and Python dist always rebuilt from source.
migrate.yml: changes to supabase/migrations on main are applied by
supabase db push (idempotent), ending hand-applied production DDL.