Add PyPI publish CD (release-labelled PR -> build & upload)

Adds two GitHub Actions workflows:
- prepare-release.yml: manual dispatch; bumps version= in setup.py and opens a
  PR labelled "release".
- publish.yml: on merge of the labelled PR, builds sdist+wheel, uploads to PyPI
  via twine, then creates the version git tag + GitHub release.

Requires repo secret PYPI_API_TOKEN and the "Allow GitHub Actions to create and
approve pull requests" setting enabled.

Author: poissoncorp

.github/workflows/prepare-release.yml

@@ -0,0 +1,61 @@
+name: Prepare release PR
+
+# Step 1 of the release flow.
+# Manually triggered. Bumps the version in setup.py and opens a PR labelled
+# `release`. Merging that PR fires `publish.yml`.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Release version, e.g. 7.2.3 (sets the ravendb package version)."
+        required: true
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Bump version
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          sed -i -E "s/version=\"[0-9][^\"]*\"/version=\"${VERSION}\"/" setup.py
+
+          echo "----- setup.py -----"
+          grep -nE 'version=|python_requires' setup.py || true
+
+          if git diff --quiet; then
+            echo "::error::No version string changed. Check the sed pattern against setup.py."
+            exit 1
+          fi
+
+      - name: Create release PR
+        uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          base: ${{ github.event.repository.default_branch }}
+          branch: release/${{ inputs.version }}
+          delete-branch: true
+          commit-message: "Release ${{ inputs.version }}"
+          title: "Release ${{ inputs.version }}"
+          labels: release
+          body: |
+            Automated release for **ravendb ${{ inputs.version }}** (Python client).
+
+            Bumps the version in `setup.py`.
+
+            > [!WARNING]
+            > Merging this PR **while the `release` label is set** triggers the
+            > **Publish to PyPI** workflow, which builds and uploads the package and
+            > creates the `${{ inputs.version }}` GitHub release.
+
+            Review the diff, then merge to publish. Remove the `release` label before
+            merging if you do **not** want to publish.

.github/workflows/publish.yml

@@ -0,0 +1,62 @@
+name: Publish to PyPI
+
+# Step 2 of the release flow.
+# Fires when a PR labelled `release` is merged (the PR opened by prepare-release.yml).
+# Also runnable manually as an emergency fallback (publishes whatever is on the branch).
+
+on:
+  pull_request:
+    types: [closed]
+  workflow_dispatch:
+
+permissions:
+  contents: write # create the git tag / GitHub release
+
+jobs:
+  publish:
+    # Only on manual run, or on a merged PR that carried the `release` label.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.pull_request.merged == true &&
+       contains(github.event.pull_request.labels.*.name, 'release'))
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.base.ref || github.ref_name }}
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install build tooling
+        run: python -m pip install --upgrade pip setuptools wheel twine
+
+      - name: Build sdist + wheel
+        run: python setup.py sdist bdist_wheel
+
+      - name: Read package version
+        id: ver
+        run: echo "version=$(python setup.py --version)" >> "$GITHUB_OUTPUT"
+
+      - name: Publish to PyPI
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+        run: twine upload --non-interactive --skip-existing dist/*
+
+      - name: Tag & GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.ver.outputs.version }}
+          TARGET: ${{ github.event.pull_request.base.ref || github.ref_name }}
+        run: |
+          set -euo pipefail
+          if gh release view "${VERSION}" >/dev/null 2>&1; then
+            echo "Release ${VERSION} already exists, skipping."
+          else
+            gh release create "${VERSION}" \
+              --target "${TARGET}" \
+              --title "${VERSION}" \
+              --notes "ravendb ${VERSION} published to PyPI."
+          fi