Summary

• replace the minimal deploy shell chain with a guarded release script
• refuse deploys outside main/master and refuse dirty working trees
• use the active Python environment instead of Homebrew/system python3 pip installs
• support optional version bump commits via ./deploy.sh
• build/upload with python -m build and python -m twine, then tag and push v
• bump mhctools to 3.13.5

Fixes #202.

Validation

• python -m pytest tests/test_deploy_script.py
• ./lint.sh
• ./test.sh
• manual branch guard: ./deploy.sh on fix-deploy-script-workflow exits before deploy with the expected non-main/non-master error