ci: use trusted publishing in release pipeline and trigger on tags

[Yonghui-Lee]

This PR makes release pipeline automatically run tests, build packages, create GitHub releases, and publish to PyPI upon a new tag push.

Close #1866

Key Changes

1. CI Workflow (main.yaml):
   • Added the workflow_call trigger to allow the CI workflow to be called by the release workflow.
2. Release Pipeline (pypipublish.yaml):
   • Trigger: Configured to trigger automatically on CalVer tag pushes (e.g., 2026.6.0).
   • CI Dependency: Added a ci job dependency to ensure all tests pass before any build or publish steps run.
   • Build: Uses the standard build module to generate source distributions and wheels.
   • GitHub Release: Automatically creates a GitHub release, generates release notes, and attaches the build artifacts.
   • PyPI Publish: Switched from legacy username/password secrets to Trusted Publishing (OIDC) using the official pypa/gh-action-pypi-publish action.

Setup Required

Trusted Publishing must be configured on PyPI.