Add test suite, CI, and PyPI trusted-publishing workflow (#2)

* Add tests, CI, and PyPI trusted-publishing workflow

Extract the pure shared-memory parse path into _parse_shared_memory(buf) so
the untrusted-header bounds checks can be exercised with synthetic byte
buffers — no Win32 or live HWiNFO instance required.

- tests/: config validation + sensor filtering, JSONL logging/rotation/
  retention, and shared-memory parser bounds checks (39 tests).
- pyproject: dev-dependency group (pytest, twine); trim the heavy worked-
  example artifacts (.png/.parquet/.jsonl) from the sdist.
- CI (ci.yml): build + test on ubuntu/windows x py3.12/3.13, actions SHA-pinned.
- publish.yml: OIDC trusted publishing on GitHub Release with PEP 740
  attestations and no stored token.
- Docs: README CI-scope note + status badge, CONTRIBUTING release recipe.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Lock dev dependencies (pytest, twine) in uv.lock

Refresh the lockfile to include the new dev-dependency group so CI's
`uv sync` installs the pinned test/build toolchain reproducibly.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Address PR review: parser hardening + deterministic logger tests

- Downgrade the malformed-buffer backstop from log.exception to log.warning:
  reaching it means untrusted/incompatible input slipped past validation, not
  an internal bug, so a full traceback is noise (matches the other rejection
  paths).
- Add a sensor/entry section-overlap guard to _parse_shared_memory: a corrupt
  header could alias the two arrays; reject rather than emit bogus readings.
- Freeze pendulum.today via monkeypatch in the retention-cleanup tests so the
  cutoff math is fully deterministic; correct the module docstring accordingly.
- Add tests: section overlap, control-character stripping, and the
  name_original fallback when the user-facing name is blank.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Add TestPyPI dry-run workflow; make PEP 740 attestations explicit

- Add .github/workflows/publish-testpypi.yml: a manually-triggered
  (workflow_dispatch) dry run of the OIDC publish path against TestPyPI. It
  mirrors publish.yml (build -> test gate -> twine check -> OIDC publish +
  attestations) but targets test.pypi.org and is idempotent (skip-existing),
  so the full pipeline can be validated without touching real PyPI.
- Set `attestations: true` explicitly on both publish steps. PEP 740
  attestations are signed via Sigstore using the ambient OIDC token
  (id-token: write) and uploaded to the index — this does not use GitHub's
  attestation store, so `attestations: write` is not required. The explicit
  value documents intent and fails loudly if attestations can't be produced.
- CONTRIBUTING: document the dry-run workflow and its TestPyPI publisher config.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Leonard Janke <lcjanke2020@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>