ci: build and publish package to Gitea registry on tag

Add .gitea/workflows/publish.yml: on a v* tag, gate on the existing lint + test
jobs, then build sdist+wheel with uv and publish to the self-hosted Gitea PyPI
registry using least-privilege Actions secrets (GITEA_PACKAGE_USER /
GITEA_PACKAGE_TOKEN). The job fails loudly when the secrets are absent rather
than publishing anonymously, uploads the built artifacts, and leaves a disabled
public-PyPI stub. Public PyPI is intentionally not published in this pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -253,6 +253,7 @@ Gitea workflows were added under `.gitea/workflows/`:
 - `lint.yml`: Ruff + formatting + mypy.
 - `test.yml`: lint + pytest + enforced coverage (`>=80%`).
 - `docker.yml`: lint+test gated Docker build, SHA tag, `latest` tag on `main`.
+- `publish.yml`: on a `v*` tag, lint+test gated `uv build` + publish the Python package to the Gitea PyPI registry (see `docs/packaging.md`).
 
 ## Docker hardening