Consolidate CI workflows into one

[EpicWink]

To reduce duplicate release (aka PyPI publish) jobs. This is primarily to reduce the number of Trusted Publishers required to be configured for #1169.

There's likely duplicate between the build and test jobs for each platform, but I didn't want to mess with anything, so it's all just copy-pasted into one file.

The only lost piece of functionality is skipping CI for pull requests if only the other platform's CI configuration has changed. I consider this very minor and unlikely, so I don't think it's worth it to keep.

[Mukller]

This cleanly resolves the biggest operational blocker flagged in #1169 (comment): with publishing consolidated into a single workflow, the trusted-publisher matrix collapses from ~4 workflow filenames × 12 project/index combinations to one filename per project.

Triage note now that three PRs overlap in this area:

• This PR (Consolidate CI workflows into one #1265) — consolidation; natural base for the migration.
• Use official action to publish package in CI #1169 (same author) — original twine → trusted-publishing migration across the four split workflows. Once this lands, its publish-job parts are superseded; anything not CI-related there can rebase on top.
• Use trusted publishing #1264 (@kohtala) — trusted publishing plus a separate orthogonal improvement (GitHub-hosted runners for ubuntu-arm64 / macOS intel & M1). The runner part could stack on top of this PR independently.

Suggest also copying the full PyPI/TestPyPI pending-publisher checklist (all four package names × both indexes) into this PR's description — whoever merges is going to be following it as the setup guide.