ci: release successful main builds

[MikiEEE]

Summary

• add CI for pull requests and pushes to develop and main on Python 3.10 and 3.12
• install the complete optional test stack, run tests and compile checks, then build and inspect wheel and source archives
• cut a tagged GitHub release only after successful CI for the exact current main commit
• serialize publication, recheck main immediately before publishing, attest artifacts, and pin every GitHub Action to an immutable revision
• fix the Response default factory incompatibility exposed by the Python 3.12 CI job
• document versioning, local checks, and the deliberate GitHub-only publishing boundary

Release boundary

This creates GitHub releases but does not publish to PyPI. SmallOS is still sourced from Git master through requirements.txt and is not a declared installable runtime dependency in pyproject.toml.

Validation

• workflow YAML parses successfully and every action reference is a 40-character commit SHA
• GitHub CI passes on Python 3.10 and 3.12, including the package job
• current local suite passes
• wheel and source distribution build successfully
• twine check passes for both artifacts
• critic, adversarial, and release-documentation reviews pass after optional-suite, race, action-pinning, and Python 3.12 remediation