[ThomasWaldmann]

This ports master's release automation to 1.4-maint. Pushing a release tag now does the release.

release job (.github/workflows/release.yml, a reusable workflow called from ci.yml):

• builds the sdist (python -m build --sdist, twine check),
• checks that the sdist version is the tag version (a modified checkout would make setuptools-scm silently produce a .devN version),
• checks that it installs and runs in a clean venv,
• attests its build provenance,
• drafts the GitHub release with the sdist and all standalone binaries attached. It warns if an expected binary is missing (vm_tests is continue-on-error).

pypi job (ci.yml): uploads the sdist to PyPI via trusted publishing, gated by the pypi environment. It can't live in the reusable workflow because PyPI trusted publishing doesn't support that.

Sigstore bundles: every release asset gets <asset>.sigstore.jsonl for offline verification. The binary jobs (native_tests, vm_tests) now copy their attestation bundle next to the binaries before uploading the artifact. In vm_tests the attestation now runs before the upload, not after it.

Removed scripts: the sdist is no longer built, GPG-signed or uploaded locally, so scripts/sdist-sign and scripts/upload-pypi are removed. The release checklist in docs/development.rst is updated. docs/binaries/00_README.txt now explains how to verify the sdist's attestation.

Differences from master: 1.4 binary names (glibc235, macos-15, freebsd-14), 1.4 build dependencies, the existing 1.4 action pins, and no GPG step in the draft release.

Notes:

• All of this only runs on tags, so this PR's CI doesn't exercise it. The first real run will be the next 1.4.x tag.
• The PyPI trusted publisher (ci.yml, environment pypi) and the pypi environment are already used by master. They aren't tied to a branch, so they should cover 1.4-maint too.
• actionlint: no new findings except SC2046 on the gh release asset list, which is the deliberate word splitting copied from master.

🤖 Generated with Claude Code