build: 通过 Trusted Publishing 发布 0.0.1.dev1 到 PyPI

首个公开版本走预发布，先验证发布链路与包元数据，稳定版另发。
发布授权用 PyPI Trusted Publishing 而非 API token，仓库里不落任何
长期凭证；打 v* tag 或手动触发即可发版。

Author: moonyue-w

.github/workflows/release.yml

@@ -0,0 +1,31 @@
+name: Release
+
+# 打 v* tag 或手动触发时构建并发布到 PyPI。
+# 通过 PyPI Trusted Publishing 授权，仓库里不保存任何长期凭证。
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # Trusted Publishing 换取短期令牌所必需
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+
+      - name: Build sdist and wheel
+        run: |
+          python -m pip install --upgrade build twine
+          python -m build
+          twine check dist/*
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@v1.14.2

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "qca"
-version = "0.1.0"
+version = "0.0.1.dev1"
 description = "Typed synchronous and asynchronous clients for Qoder Cloud Agents"
 authors = [{name = "Qoder"}]
 license = "MIT"