Add release.yml with uv publish trusted publishing

[sderev]

What changed

• Add .github/workflows/release.yml.
• Use uv publish --trusted-publishing always (OIDC, keyless).
• Build and publish split into two jobs.
• Publish only on stable semver tags (vX.Y.Z or X.Y.Z).

Why

Keyless trusted publishing via OIDC is the recommended PyPI approach.
uv publish replaces pypa/gh-action-pypi-publish.

How to test

• Create a pre-release on GitHub; the publish job should be skipped.
• Create a stable release (e.g., v1.0.0); the package should appear on PyPI.
• Verify the trusted publisher is configured on pypi.org for sderev/lmtoolbox.

Risk

• Requires PyPI trusted publisher configured for this repo.
• No GitHub environment protection rules (environment block omitted).

Changelog fragment

No (internal CI change, not user-facing).