ci: Split workflow into test-build and post-build via workflow_run (#273)

* ci: Split workflow into test-build and post-build via workflow_run

Move deploy-preview-wheel, publish-to-pypi, and github-release into a
separate workflow triggered by `workflow_run`, so they execute in the
trusted default-branch context with access to repository secrets.
PRs from forks (including Dependabot) no longer fail the deploy job
due to missing secret access.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci: Read streamlit version via `uv pip show` instead of the CLI

`uv run streamlit version` invokes streamlit's CLI, which calls
`click.get_os_args()` in older releases (1.6.0, 1.8.0) — that helper
was removed from modern click, so the step crashes with AttributeError.
`uv pip show` reads metadata directly and works across all matrix
versions.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci: Address review nits in workflow split

- Collapse duplicated echo + redirect in post-build's `Read build info`
  step into a single `tee -a "$GITHUB_OUTPUT"` pipeline.
- Add a comment near `set-build-info` flagging that new `on:` triggers
  must extend the per-event branches.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: whitphx