fix: correct bash variable expansion in PyPI verification step

[boscorat]

Problem

The promote-release.yml workflow is failing to verify packages on PyPI with HTTP 404 errors, even though the package upload succeeds. This is a bash variable expansion bug in the PyPI verification step.

Root Cause

Line 152 of the workflow uses a single-quoted heredoc:

if python3 << 'PYEOF'

Single quotes prevent bash from expanding variables. This causes $PKG_NAME and $VERSION to be passed as literal strings to the Python verification script, which then queries PyPI with a malformed URL:

https://pypi.org/pypi/%24PKG_NAME/json  ← HTTP 404

Instead of:

https://pypi.org/pypi/uk-bank-statement-parser/json  ← HTTP 200

Solution

Remove the single quotes from the heredoc delimiter (line 152):

Before:

if python3 << 'PYEOF'

After:

if python3 << PYEOF

Unquoted heredocs allow bash variable expansion, so the Python script receives the actual package name and version.

Impact

• ✅ Fixes the v0.3.7 promotion failure
• ✅ Enables re-running the workflow if verification fails (idempotent behavior)
• ✅ Works with already-uploaded packages on PyPI (since PyPI accepts re-uploads)

Testing

Re-run the promote-release.yml workflow for tag v0.3.7:

1. Package is already on PyPI (from the failed run)
2. Verification script should now find it with HTTP 200
3. Release should be promoted to live