Add PyPI publish workflow with Trusted Publishing

Automatically publish to PyPI when a GitHub release is created.
Uses PyPI Trusted Publishing (OIDC) for secure, tokenless authentication.
Runs full test suite on Python 3.9-3.13 before publishing.