feat: add PyPI publishing via trusted publisher and dynamic versioning

[anfredette]

Description

Add PyPI publishing to the release pipeline using OIDC trusted publishing, and switch to hatch-vcs for git-tag-based versioning.

Changes:

• Switch from hardcoded version = "0.1.0" to dynamic = ["version"] with hatch-vcs, so the wheel version is derived from git tags
• Add PyPI publish job to release.yml using pypa/gh-action-pypi-publish with OIDC trusted publisher
• Add build job that builds the wheel and verifies the version matches the git tag before publishing
• Make GitHub release creation idempotent (re-run a tag without failing)
• Add release-status summary job that fails if either release or publish failed
• Add fetch-depth: 0 to all CI checkout steps so hatch-vcs can resolve the version
• Expose __version__ in the planner package via the hatch-vcs generated _version.py
• Add project metadata to pyproject.toml (license, classifiers, URLs)
• Add wheel E2E test asserting hatch-vcs resolves a real version

Prerequisites (already done):

• "pypi" environment configured in repo settings
• Workflow registered as a trusted publisher on pypi.org

How Has This Been Tested?

• CI passes with the fetch-depth: 0 changes (hatch-vcs resolves version in all jobs)
• Wheel E2E test validates that the installed package has a real version (not fallback)
• uv build produces a wheel with the correct version locally
• Version verification step tested by inspecting wheel filename against tag format

Merge criteria:

• The commits are squashed in a cohesive manner and have meaningful messages.
• Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
• The developer has manually tested the changes and verified that the changes work