Split publish into its own workflow without GraphQL

[JE-Chen]

Summary

• Extract the publish pipeline into a dedicated .github/workflows/publish.yml modelled on APITestka's publish.yml — runs on push: main, guarded by a concurrency group and an if: that skips when the head commit starts with chore: bump version so the bump commit itself never re-triggers publishing.
• The publish job bumps both stable.toml and dev.toml, copies stable.toml to pyproject.toml, builds, twine uploads to PyPI, then git commit + git tag vX.Y.Z + git push origin main + git push origin vX.Y.Z, then gh release create. No GraphQL — fixes the "GitHub Actions is not permitted to create or approve pull requests" failure the PR-based bump hit.
• Trim .github/workflows/ci-stable.yml down to lint + pytest (no more publish job / pull-requests: write permission).
• CLAUDE.md Branching & CI section updated to describe the new workflow split and the commit-message skip guard.

Test plan

• Both workflow YAML files parse cleanly (yaml.safe_load)
• After merge, verify publish.yml runs on push to main, bumps + tags + creates release on PyPI
• Confirm the follow-up chore: bump version ... commit does not re-trigger publish.yml (skipped by if: guard)

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{TIP This summary will be updated as you push new changes. Give us feedback}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud