feat: Add GitHub Actions workflows for CI and automated PyPI publishing

[jcpitre]

Closes #3

What this adds

• python-test.yml — runs the test suite on Python 3.10–3.13 on every release or manually.
• python-release.yml — triggered when a GitHub Release is published. Runs the full test matrix first, then builds and publishes the package to PyPI using Trusted Publisher (OIDC) — no API token required.

How to cut a release

See the new Releasing a New Version section in README.md.

⚠️ Post-merge requirements

These workflows can only be fully tested after this PR is merged, because:

1. GitHub requires workflow files to exist on the default branch before they can be triggered manually or via workflow_dispatch.
2. PyPI's Trusted Publisher configuration must reference the exact workflow file on the default branch. A maintainer will need to register the Trusted Publisher on PyPI (instructions) pointing to MobilityData/gtfs-diff-engine, workflow python-release.yml, environment pypi.

Recommended follow-up (requires admin): Enable branch protection on main to require ci.yml status checks to pass before merging. This prevents a release from being cut from a broken main. Go to Settings → Branches → Add branch ruleset, and require the test, lint, and models-freshness jobs as required status checks.

[cka-y]

I believe this is already covered by ci.yml

[jcpitre]

Do we want tests to run before release? Or do we trust that ci.yml ran properly?
python-test.yml is essentially called from python-release.yml.
It could have been embedded in python-release.yml.

• ci.yml is a smart gate — runs conditionally on path changes, designed for PR feedback speed
• python-test.yml is a release safety net — runs unconditionally, designed for correctness at publish time

I suggest we keep both.

[cka-y]

sure! could we support the same python versions?

[jcpitre]

Done.
The rationale for the versions used in python-test.yml was that if it works with 3.13 then it must work with 3.12. But it's not guaranteed, so your comment is spot on.
I curious to know why you did not include 3.11 in the list of versions?

[cka-y]

My understanding at the time was that python 3.10 is still supported (security updates), but not 3.11. I just looked it up i'm completely wrong they are both in their final "security-only" support phase.

[cka-y]

LGTM

[jcpitre]

Generated a release (V0.1.0)
Verified that it can be obtained from pypi.