ci(publish-python): twine upload --verbose to expose 400 cause

The v3.2.0 release fails on the second wheel upload to PyPI with a
generic 400 Bad Request. twine swallows the response body unless
--verbose is set; this commit adds the flag so the next retry surfaces
the actual reason from PyPI.

Author: claude

.github/workflows/publish-python.yml

@@ -108,8 +108,12 @@ jobs:
       - name: List wheels
         run: ls -la dist/
 
-      # Upload native wheels to GitHub Releases (NOT to PyPI)
+      # Upload native wheels to GitHub Releases (NOT to PyPI).
+      # Guarded by a tag check so workflow_dispatch from a branch can still
+      # exercise the PyPI publish path for debugging without the GitHub
+      # Release steps tripping on a missing release name.
       - name: Ensure release exists and upload native assets
+        if: startsWith(github.ref, 'refs/tags/')
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
@@ -124,6 +128,7 @@ jobs:
 
       # Generate manifest with wheel metadata for bootstrap downloader
       - name: Generate native wheel manifest
+        if: startsWith(github.ref, 'refs/tags/')
         run: |
           python .github/scripts/generate_python_release_manifest.py \
             dist \
@@ -132,6 +137,7 @@ jobs:
 
       # Upload manifest to GitHub Releases
       - name: Upload manifest to GitHub Releases
+        if: startsWith(github.ref, 'refs/tags/')
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
@@ -144,4 +150,4 @@ jobs:
           TWINE_PASSWORD: ${{ secrets.PYPI_NATIVE_TOKEN }}
         run: |
           python -m pip install --upgrade pip twine
-          python -m twine upload --skip-existing dist/*.whl
+          python -m twine upload --verbose --skip-existing dist/*.whl