Add manual publish-to-JFrog workflow for iam-ape

[yanas-orca]

What

Adds .github/workflows/publish-iam-ape.yaml — a workflow that builds and publishes only the iam-ape package to Orca's JFrog PyPI repo (orca-pypi). Modeled on orcasecurity/orca_textract's publish.yaml.

Design constraints (as requested)

• Manual dispatch only — on: workflow_dispatch; no push/tag/PR triggers.
• Write-permission users only — inherent to workflow_dispatch: GitHub only allows users with Write access to trigger it.
• iam-ape only — working-directory: iam-ape, so no other tool in this repo is built or published.
• Publishes with twine to https://orcasecurity.jfrog.io/artifactory/api/pypi/orca-pypi using secrets.JFROG_RW_USER / secrets.JFROG_RW_PASSWORD, with --skip-existing (safe re-runs).

⚠️ Requires a secret to be provisioned before it can publish

This repo (public) currently has no Actions secrets (0 repo-level, 0 org-scoped). Before the workflow can authenticate, an org admin must add JFROG_RW_USER and JFROG_RW_PASSWORD to orca-toolbox — either as repo secrets or by scoping the existing org secret to this repo. Exposing read-write artifact creds to a public repo is a deliberate decision; the manual-dispatch-only trigger (no PR/fork exposure) is the mitigation.

Usage

Once the secrets exist, bump iam-ape/pyproject.toml version, then run this workflow from the Actions tab to publish — including the interim 1.1.7 release.

[orca-security-eu]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud