Release workflow: narrower permissions, no inline expansion, one run per tag

[TMHSDigital]

The problem

.github/workflows/release.yml:

• The whole job has contents: write (:17) while it runs uv sync and pytest, so any dependency executed during the build has a write token.
• ${{ inputs.tag || github.ref_name }} is expanded directly into shell at :49, :70 and :95. A manual dispatch with a crafted tag string is a script injection.
• The concurrency group release-${{ github.ref }} does not serialize a manual dispatch against the tag-push run for the same tag, and both upload with --clobber.
• The published v0.1.0 release has no assets, and main still reports 0.1.0 many commits past the tag, with no Unreleased section to hold them.

What done looks like

• A build job with contents: read that uploads the dist as an artifact, and a separate upload job with contents: write that runs no project code.
• The tag is passed through env: and quoted, and validated against ^v\d+\.\d+\.\d+$.
• The concurrency group is keyed on the resolved tag.
• actions/attest-build-provenance on the built wheel and sdist.
• v0.1.0 gets its assets (or a note says why not), and CHANGELOG gets an Unreleased section.

[TMHSDigital]

The workflow changes landed in #91. For the last item, v0.1.0's assets: the new workflow was dispatched against the tag (run 36065736579).

• Passed: the tag check, the version check, and the full gate at the tag.
• Failed: the check that the wheel ships py.typed. The tag predates fix: ship py.typed so downstream type checkers see the annotations #16, which added that file.

The attach job was skipped, so nothing was published. The v0.1.0 release notes now open with a note saying why the release has no distributions, and how to install it from the tag. That install command was tested: it installs and plumbline version prints 0.1.0. The next release will ship attested distributions. CHANGELOG already has an Unreleased section.