Publish wheels from every CI matrix OS, and publish an sdist

[tonyhtchan]

Problem

The 0.0.2 release's publish workflow builds wheels for ubuntu-latest, windows-latest, macos-13, and macos-14 via cibuildwheel, but the publish step is gated with if: matrix.os == 'ubuntu-latest'. As a result, only the Linux wheels ever get uploaded to PyPI (confirmed on PyPI: 0.0.2 only has manylinux...x86_64 wheels, no macOS/Windows wheels, and no sdist).

This means anyone installing on macOS, Windows, or any Python/platform combination not covered by the published wheels falls back to pip trying to build from source -- but since there's no sdist for 0.0.2, pip falls back all the way to the last published sdist, 0.0.1.post1, which predates the current pyproject.toml/simplified setup.py and fails to build on modern Python (e.g. its shipped pre-generated irrep_bases.c references longintrepr.h, removed in Python 3.11).

I confirmed master as-is (this repo's current state) already builds and installs cleanly via a plain pip install . on Python 3.11/macOS arm64 -- no source changes needed, just the CI publishing gap.

Fix

Restructures .github/workflows/publish.yaml into three jobs:

• build_wheels -- same build logic as before, just per-OS artifact names (wheels-${{ matrix.os }}) so multiple OS's wheel artifacts don't collide.
• build_sdist (new) -- builds an sdist via pipx run build --sdist.
• publish (new) -- downloads every wheel artifact plus the sdist, and publishes all of them together. Moved the environment: release / id-token: write permissions here, since this is the job that actually needs them.

Testing

Verified locally that a clean pip install of this repo's master (no flags, no pins) builds and works correctly on Python 3.11 (macOS arm64):

$ python -m venv clean_test && clean_test/bin/pip install /path/to/lie_learn
...
Successfully installed lie_learn-0.0.2 numpy-2.4.6 scipy-1.17.1 ...

$ clean_test/bin/python -c "
from lie_learn.representations.SO3.wigner_d import wigner_D_matrix
print(wigner_D_matrix(1, 0, 0, 0))
"
[[1. 0. 0.]
 [0. 1. 0.]
 [0. 0. 1.]]

Didn't have Windows/Linux available to test those specifically, but the wheel-building steps for those OSes are unchanged from the existing (working) workflow -- only the publish step and artifact naming changed.