ci(release): auto-create GitHub Release after PyPI publish

.github/workflows/python-publish.yml

@@ -88,4 +88,46 @@ jobs:
           path: dist/
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+
+  create-release:
+    name: Create GitHub Release
+    needs: publish-to-pypi
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: write
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Extract release notes from CHANGELOG
+        id: notes
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          # Extract the section between this version's heading and the next "## [" heading.
+          # Uses string functions instead of regex to stay portable across awk variants.
+          notes=$(awk -v v="$version" '
+            BEGIN { start = "## [" v "]"; flag = 0 }
+            substr($0, 1, length(start)) == start { flag = 1; next }
+            substr($0, 1, 4) == "## [" { flag = 0 }
+            flag { print }
+          ' CHANGELOG.md)
+          if [ -z "$(printf '%s' "$notes" | tr -d '[:space:]')" ]; then
+            echo "::warning::No CHANGELOG entry found for v${version} — using fallback body"
+            notes="Release v${version}. See commit history for changes."
+          fi
+          {
+            echo "notes<<EOF_GH_OUTPUT"
+            printf '%s\n' "$notes"
+            echo "EOF_GH_OUTPUT"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        with:
+          name: ${{ github.ref_name }}
+          body: ${{ steps.notes.outputs.notes }}
+          draft: false
+          prerelease: ${{ contains(github.ref_name, '-') }}