build: prepare v0.1.0 PyPI release

[gokul-debugger]

Summary

• add a two-job PyPI Trusted Publishing workflow with isolated OIDC permissions
• pin every release action to an immutable commit and disable credential persistence
• validate release tag and package version consistency before building
• build, validate, smoke-test, and retain wheel and source distributions before publishing
• add package validation to regular CI
• document the release process and replace editable-install instructions with PyPI and pipx usage
• make README links render correctly on PyPI
• keep the GitHub client User-Agent synchronized with the package version

Verification

• 52 tests passed
• Ruff check and format check passed
• mypy passed
• wheel and source distribution built successfully
• Twine 7 validated both distributions
• clean-environment wheel installation and CLI smoke test passed
• zizmor reported no GitHub Actions security findings

Publication safety

This PR does not create a tag or publish a package. Publishing remains gated by the pypi GitHub environment and PyPI Trusted Publisher configuration.