build: prepare watchpost-cli trusted publishing

[ejames-dev]

Summary

• Use the user-selected distribution name watchpost-cli: watchpost is occupied by an unrelated project on PyPI and TestPyPI. Keep the repository, CLI command, and import module unchanged.
• Add an installed-distribution identity/entry-point test and use the manifest name in installed-wheel CI.
• Add publish.yml, a manual-only Trusted Publishing workflow. Tags and GitHub Releases do not trigger registry uploads.
• Document exact pending-publisher fields and registry verification instructions. Make release-status prose refer to actual publication records rather than assuming that metadata implies publication.

Publishing boundaries

• TestPyPI accepts main; PyPI requires a tag matching the package version. Both require commits reachable from main.
• Only the upload job has id-token: write. Build has read-only source access. No stored PyPI API token.
• Build once per run, validate metadata, smoke-test the wheel, and verify checksums before upload. Separate registry runs produce separate bundles.
• Required-reviewer environments configured separately in GitHub: reviewer ejames-dev, self-review allowed for this solo maintainer, administrator bypass disabled. testpypi permits only main; pypi permits v* tags.
• No upload, OIDC exchange, release tag, or GitHub Release was performed. User account-side publisher setup and explicit registry-upload approval remain pending.

Verification

• 51 tests pass on Python 3.11, 3.12, and 3.13; pytest and Ruff pass.
• Renamed wheel and source archive build and pass twine check --strict.
• Extracted source archive installs with its lockfile and passes all 51 tests.
• YAML, pinned action refs, shell syntax, manual trigger, permissions, and positive/negative source-ref/name guards checked.
• Actual build, metadata-check, installed-wheel smoke, and checksum shell steps passed locally without any upload steps.
• GitHub environment reviewer, bypass, and ref restrictions verified through the API.
• Runtime modules unchanged; local signature verified.

Docker/act and independent reviewer tools were unavailable. OIDC/publishing end-to-end verification is deliberately pending the first approved TestPyPI run.

Maintainer action

Add a pending GitHub publisher on each registry: project watchpost-cli, owner ejames-dev, repository watchpost, workflow publish.yml, environment testpypi or pypi respectively. Do not create an API token. See docs/publishing.md.