Publish an sdist and stop partial releases on PyPI

[philomath213]

Restructures the publish workflow into build -> verify -> publish, and adds an opt-in TestPyPI rehearsal.

Depends on #521 — the sdist needs the MANIFEST.in added there. CI here will fail until that merges.

• One upload per release. Each of the 12 matrix cells currently runs twine upload itself, so a failure partway through leaves a half-published release. The matrix now only uploads artifacts; a single publish job does one upload.
• Ships an sdist. Only wheels are published today, so pip install tenseal on any unlisted platform simply fails.
• Builds a wheel from the sdist and imports it — the only check that catches an incomplete MANIFEST.in. An sdist missing CMakeLists.txt, cmake/ or the .proto files still passes twine check, then fails for everyone building from source.
• Triggers on release: published, keeping workflow_dispatch.
• TestPyPI rehearsal (dispatch-only, the default): publishes, then installs back on all three platforms and runs a real CKKS op. --extra-index-url is required, as TestPyPI has no numpy.
• stamp_dev_version.sh appends .dev<run_number> for rehearsals only — both indexes refuse to overwrite an existing version.

Real releases are unaffected: release: published always targets PyPI with the existing PYPI_USERNAME/PYPI_PASSWORD secrets.