Require release tags for publishing

[cbusillo]

Summary

• require the manual Publish workflow to run from a v* tag
• verify the package version in pyproject.toml matches the selected release tag
• update release docs to say the publish workflow should be run from the release tag

Verification

• git diff --check
• ruby -e "require 'yaml'; YAML.load_file('.github/workflows/publish.yml')"\n- actionlint .github/workflows/publish.yml .github/workflows/ci.yml\n- uv run pytest\n- rm -rf dist && uv build\n- uv run twine check dist/*\n\n## Release Note\nAfter this merges, recreate the unpublished v0.3.0 tag/release at the merge commit before running TestPyPI/PyPI publishing.