Fix TestPyPI trusted publishing identity

[justinjoy]

Summary

• split release publishing into separate TestPyPI and PyPI jobs
• assign explicit GitHub environments: testpypi for dry runs and pypi for production tags
• keep artifact verification and attestation before each publish path
• document the required TestPyPI trusted publisher environment for Perform a TestPyPI dry run for v1.0.0 artifacts #130

Validation

• PYTHONPATH=src pytest --no-cov -q tests/test_release_workflow_yaml.py tests/docs/test_release_candidate_checklist.py -> 34 passed
• python - <<'PY' ... yaml.safe_load(...) ... PY -> release.yml parsed
• git diff --check HEAD~2..HEAD
• actionlint .github/workflows/release.yml

Fixes #130 after TestPyPI trusted publisher is configured for environment testpypi and the dry run succeeds.