Prepare version-bump PRs and publish after merge

[Dale (dalemyers)]

Summary

• Add a manual Prepare release PR workflow with patch/minor/major inputs. It updates pyproject.toml and creates or updates a normal release/version-bump PR using a scoped GitHub App token.
• Keep required review and CI intact. There is no automatic merge, direct version-commit push to main, or branch-protection bypass.
• When a version change reaches main, build the exact merged commit, push only its version tag, create a GitHub release, publish to PyPI, and attach signed distributions in the same run.
• Skip publishing for dependency-only metadata changes. Reject existing tags that point at different source, including conflicting remote tags.
• Retain manual existing-version publishing, default TestPyPI publishing, and manually published GitHub release triggers.

Setup

For automated PR creation, install an organization-approved GitHub App with Contents: read/write and Pull requests: read/write. Configure RELEASE_APP_CLIENT_ID as an Actions variable and RELEASE_APP_PRIVATE_KEY as an Actions secret. The token is limited to this repository and these permissions. No RELEASE_TOKEN or permission-bypass setting is needed.

If App setup is unavailable, a maintainer can open the version-bump PR manually; the same post-merge publication runs without App credentials. Existing PyPI/TestPyPI trusted publishing remains in publish.yml. Tag rules must allow Actions to create release tags.

Validation

• 23 focused regression cases cover input validation, real Poetry bumps, unchanged versions, missing history, exact merged-SHA tagging, local/remote tag conflicts, and permission/event routing.
• Tests use local temporary Git repositories; no release or package was published.
• Both workflows pass actionlint; the regression tests pass Black, Pylint, mypy, and Pyright.