fix: ensure release.yml calls CI first via run_tests reusable workflow

Add a `run_tests` job that calls `.github/workflows/ci.yml` as a
reusable workflow, and make `release` depend on it via `needs: run_tests`.
Move permissions from workflow-level to job-level for least-privilege.
No PYPI_UPLOAD_TOKEN or password fields — OIDC pattern preserved.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: farhan

.github/workflows/release.yml

@@ -4,14 +4,20 @@ on:
     tags:
       - '*'
 
-permissions:
-  id-token: write  # Required for OIDC
-  contents: write  # For Semantic Release tagging
-
 jobs:
+  run_tests:
+    uses: ./.github/workflows/ci.yml
+    secrets: inherit
+    permissions:
+      contents: read
+
   release:
     name: Release
+    needs: run_tests
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # Required for OIDC
+      contents: write  # For Semantic Release tagging
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1