feat(release): add release-please automation and bump version to 0.1.0

[tildesrc]

Summary

• Bumps version from 0.0.1 to 0.1.0 in pyproject.toml, src/panopticon/__init__.py, and .release-please-manifest.json so pip install panopticon-app gets the post-feat(migrations): bundle Alembic migrations into the package #261/feat(sessionservice): bundle Docker files in package & fix image builder #262/feat: adopt XDG Base Directory spec for all default data paths #263/feat(terminal): add panopticon build/host/start/stop subcommands #267 packaging fixes
• Adds # x-release-please-version markers so future version bumps are automated
• Adds .github/workflows/release-please.yml — watches main, auto-opens a release PR on each push using conventional commits, publishes a GitHub Release when that PR merges
• Adds .github/workflows/release.yml — triggers on release: published, runs full CI (typecheck + tests), builds wheel + sdist, uploads to PyPI via OIDC trusted publishing
• Adds release-please-config.json and .release-please-manifest.json (release-please config, package name panopticon-app)
• Adds docs/releasing.md with the full release procedure and one-time setup instructions

Based on #255, with two corrections: pyproject.toml uses name = "panopticon-app" (not panopticon), so the release-please-config.json package-name and docs/releasing.md PyPI trusted publisher values are fixed accordingly. Also bumps to 0.1.0 (PR #255 left everything at 0.0.1).

One-time setup required after merge (documented in docs/releasing.md)

1. Create a repository secret named RELEASE_PLEASE_TOKEN — a fine-grained PAT or GitHub App token with Contents, Issues, and Pull requests write access. The default GITHUB_TOKEN cannot be used because PRs it opens don't trigger follow-on workflows.
2. Create a GitHub environment named pypi (Settings → Environments). Optionally require manual approval as a final gate before each PyPI upload.
3. Configure a PyPI trusted publisher with these exact values:

   PyPI project/package: panopticon-app
   Owner:                Unsupervisedcom
   Repository:           panopticon
   Workflow filename:    release.yml
   Environment name:     pypi
   

   If panopticon-app doesn't exist on PyPI yet, add a pending trusted publisher from the PyPI account Publishing page — the first successful publish creates the project.

After merge

release-please will open a chore(main): release 0.1.0 PR. Merging that PR publishes a GitHub Release, which triggers .github/workflows/release.yml to upload panopticon-app 0.1.0 to PyPI.

Important: the PyPI publish must complete before running panopticon build for that version, because panopticon build bakes pip install panopticon-app==0.1.0 into the base container image.