Fix release publishing, direct pushes, and macOS 3.14 wheels

[saulshanabrook]

Summary

Fix release run 35527600540 and simplify future releases:

• Publish with uv publish instead of deprecated maturin upload, using the existing PYPI_API_TOKEN and downloaded artifacts in dist/.
• On a manual dispatch from main, create a version commit with [skip ci] and build every package from that exact SHA. Do not open a release PR or run redundant push/PR CI for the version commit. Normal development PR checks remain unchanged.
• After publishing, atomically fast-forward main and create the release tag without force. Identical retries succeed; conflicting tags or concurrent changes to main are rejected. Check main before publishing as well.
• Fix the macOS Python 3.14/3.14t PATH collision and assert both ABIs before building, restoring the missing standard CPython 3.14 wheel.
• Update the changelog; retain full-SHA action pins.

Required setup

Add repository secret RELEASE_GITHUB_TOKEN: a GitHub token with repository contents write access whose actor is permitted to bypass main's required checks. The ordinary GITHUB_TOKEN cannot bypass them. The workflow fails before preparing or publishing a release if this secret is absent. Token presence is checked locally; GitHub authorization must still be configured correctly.

This does not change repository protection or reuse local credentials. Previously approved required-check name repairs remain in place. Keep main unchanged during a release; a race after the pre-publication check will safely reject the final push rather than overwrite work. Git and PyPI cannot be updated transactionally. [skip ci] suppresses push/PR workflows, not necessarily CodeQL default scanning or external integrations.

Validation

• Actionlint, pre-commit, whitespace checks, and all 11 version/changelog tests passed.
• Executed the actual workflow shell steps against local bare Git repositories: missing-token failure, successful push, identical retry, conflicting-tag rejection without changing main, and concurrent-main rejection without creating a tag. This exposed a shallow-checkout failure, fixed by fetching full history in the final job.
• Sphinx build passed with the existing 307 warnings.
• The prior PR head's macOS job built all four wheels. Its regular 3.14 universal2 wheel contains both arm64 and x86_64 binaries, passes a clean local arm64 install and public rewrite/check/extract smoke test, and passes uv publish --dry-run.
• Independent workflow review passed. Actual direct-push authorization has not been exercised against GitHub.

The existing v14.0.0 tag is already correct and has not been moved. Upload of the missing 14.0.0 macOS wheel is a separate repair, currently waiting for a local PyPI credential; existing PyPI files will not be replaced.

[codspeed]

Merging this PR will not alter performance

✅ 14 untouched benchmarks

---

_{Comparing codex/fix-release-publish-merge (fa5663b) with main (f833355)}