ci: publish from trusted top-level workflow

[pacharanero]

Summary

• keep testing and the single verified artifact build in the reusable package workflow
• publish from the top-level release workflow so PyPI OIDC and attestations use the supported Trusted Publisher identity
• add an explicit validated recovery dispatch for failed PyPI publications and document the corrected release model

Evidence

• v4.6.4 reusable-workflow upload failed first with an attestation identity mismatch and then with invalid-publisher after trusting only the caller
• PyPI documents reusable workflows as unsupported Trusted Publisher identities
• s/test tests/distribution/test_validate_release.py -q (11 passed)
• zizmor --strict-collection . (no medium/high findings; known low $/... suggestions conflict with GitHub's accepted local reusable-workflow syntax)
• git diff --check