chore(ci): sync publish.yml trigger to push:tags (#45)

Swap the publish workflow trigger from release:[published] to
push:tags 'v*.*.*' to match attune-ai's publish-pypi.yml pattern
(synced 2026-05-25; original change in attune-ai PR #459).

The release:[published] event does NOT fire when the release is
created by GITHUB_TOKEN (another workflow). Tag-push fires
unconditionally regardless of actor. Today's manual flow
(gh release create after tag push) keeps working; future
release-automation workflows would have failed silently on the
old trigger.

No public API or package surface affected. CHANGELOG entry under
[Unreleased]; no version bump (workflow-only change).

Author: silversurfer562

.github/workflows/publish.yml

@@ -1,9 +1,19 @@
 name: Publish to PyPI
 
 on:
-  release:
-    types: [published]
-  workflow_dispatch:  # Allow manual trigger
+  # Trigger on tag push rather than release:[published]. Releases
+  # created by GITHUB_TOKEN (i.e. by another workflow) do NOT fire
+  # the `release:[published]` event — a documented GitHub Actions
+  # limitation that bit attune-ai's v7.1.0 ship. Tag-push fires
+  # unconditionally regardless of the actor, so the workflow runs
+  # whether the release was created by `gh release create` (human),
+  # a release-automation workflow, or just `git push origin <tag>`
+  # without any release object at all. Matches the publish-pypi.yml
+  # pattern in attune-ai (synced 2026-05-25).
+  push:
+    tags:
+      - 'v*.*.*'
+  workflow_dispatch:  # Manual fallback / re-run on demand
 
 permissions:
   contents: read

CHANGELOG.md

@@ -10,8 +10,21 @@ and this project adheres to
 
 ## [Unreleased]
 
-Work in progress for the next release. Add entries here as
-changes land, not at tag time.
+### Changed
+
+- **`publish.yml` trigger swapped from `release: [published]` to
+  `push: tags: 'v*.*.*'`.** Aligns with the `publish-pypi.yml`
+  pattern in attune-ai (synced 2026-05-25; original swap in
+  attune-ai PR #459). Releases created by `GITHUB_TOKEN` (i.e.
+  by another workflow) do NOT fire the `release:[published]`
+  event — a documented GitHub Actions limitation that bit
+  attune-ai's v7.1.0 ship. Tag-push fires unconditionally, so
+  the publish workflow runs whether the release object was
+  created by `gh release create` (human flow we use today), a
+  release-automation workflow (future), or just `git push origin
+  <tag>` without any release object at all. `workflow_dispatch`
+  retained as fallback. No public API or package surface
+  affected — this is CI hygiene.
 
 ## [0.14.1] - 2026-05-25