Document how to release a CPEX plugin version to PyPI

[lucarlig]

Problem

Maintainers need a short, reliable guide for releasing a new version of an existing CPEX plugin package to PyPI.

This issue is only about documenting the release-to-PyPI process. Dependency refresh work is tracked separately in #69.

Investigation notes

Managed plugin root: plugins/rust/python-package/<slug>/.

Release contract:

• version source of truth is each plugin Cargo.toml
• matching cpex_<slug>/plugin-manifest.yaml version must equal Cargo.toml
• top-level Cargo.lock must reflect the plugin package version
• make plugins-validate checks catalog and version consistency
• releases are tag-driven per plugin
• tag format is <hyphenated-slug>-v<version>, for example rate-limiter-v0.0.5
• release workflow .github/workflows/release-rust-python-package.yaml builds and publishes one plugin per tag
• PyPI publish is allowed only for tags on main

Current managed plugins:

• encoded_exfil_detection -> tag prefix encoded-exfil-detection-v
• pii_filter -> tag prefix pii-filter-v
• rate_limiter -> tag prefix rate-limiter-v
• retry_with_backoff -> tag prefix retry-with-backoff-v
• secrets_detection -> tag prefix secrets-detection-v
• url_reputation -> tag prefix url-reputation-v

Required doc content

Add a concise maintainer section to DEVELOPING.md or a dedicated release doc that explains how to release a new plugin version to PyPI:

1. Pick plugin slug and new version.
2. Update version files:
   • plugins/rust/python-package/<slug>/Cargo.toml
   • plugins/rust/python-package/<slug>/cpex_<slug>/plugin-manifest.yaml
   • refresh Cargo.lock if needed so it records the new package version
3. Run local validation:
   • make plugins-validate
   • make plugin-test PLUGIN=<slug>
4. Merge the version bump to main.
5. Create and push the release tag from main:
   • git tag <hyphenated-slug>-v<version>
   • git push origin <hyphenated-slug>-v<version>
6. Watch the release workflow and confirm publish success.
7. Verify the package exists on PyPI at the new version.

Acceptance criteria

• Docs explain exactly how to release one existing plugin version to PyPI.
• Docs include concrete command examples.
• Docs mention tag naming rules and examples.
• Docs mention that Cargo.toml, plugin-manifest.yaml, and Cargo.lock must stay consistent.
• Docs mention release tags must be on main for PyPI publish.
• Docs avoid broader dependency refresh or ContextForge update instructions except a short pointer to separate follow-up work if needed.