feat: publish the package from CI, and clean up its references

Publishing
- .gitea/workflows/publish.yml publishes paperspec to the instance's PyPI
  registry (/api/packages/infra/pypi) when a v* tag is pushed: it checks
  the repository, builds the sdist and wheel, refuses to upload unless the
  built version equals the tag, runs twine check --strict, and uploads
  with the secrets PACKAGE_USER and PACKAGE_TOKEN (--skip-existing, so a
  rerun on the same tag is safe). Run by hand, it refuses anything but a
  tag.
- pixi dev environment: twine >= 6.1 (the first that reads Metadata 2.4),
  and `dist` (sdist and wheel) replaces the `wheel` task.
- deploy/README.md: how to set up the secrets, release a version, and
  install from the registry with pixi, uv or pip, tying paperspec to the
  registry where the installer allows it.
- CONTRIBUTING.md "Releasing": a tag versions the package; a format
  change takes the new format version as the top CHANGELOG heading, and a
  code-only release takes the next patch as a subsection, as 0.1.1 does.
- pyproject: fallback_version 0+unknown for source trees without git; the
  license expression is Apache-2.0 AND CC0-1.0, for the code and the data
  the wheel carries.

Cleanup (from an audit of every reference to the package)
- spec/00 lists src/ (the package) and tools/ (how to run it), and no
  longer says the reference implementation is not a library.
- Stale explanations fixed in pixi.toml, .gitignore, the Caddyfile, the
  vectors, context, sql and tools READMEs, docs/examples.md, docs/faq.md,
  spec/01, docs/rationale.md and docs/comparison.md: the commands, what
  they need (the tools extra), the fixture folder hale2026harmonic-damb,
  and three lines that held two sentences.
- tools/README.md counts all six commands, says what needs which extra
  (package.validate and corrections.gate need [schema]), and that the
  vectors ship but the fixtures they name do not.
- The CLI's install and clone hints point at the registry instructions and
  an https clone URL; schema.py raises an ImportError naming
  paperspec[schema], as crypto.py does for [crypto].
- check's Unicode check now guards the package's pinned constant.
- site skips build/, dist/ and *.egg-info.
- CHANGELOG 0.1.1 describes the final state.

pixi run check passes (as `python -m paperspec check`); the rebuild is
byte-identical. pixi.lock needs `pixi lock` for twine before pushing: the
publish workflow installs with --locked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/publish.yml

@@ -0,0 +1,66 @@
+# Publishes the paperspec Python package to this instance's PyPI registry when a version tag (v0.1.1) is
+# pushed; see deploy/README.md for the secrets it needs and how to install from the registry.
+# The package version comes from the tag through setuptools-scm, so the job refuses to upload unless the
+# built version equals the tag. Run it by hand only on a tag, for example after adding the secrets.
+name: publish
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+defaults:
+  run:
+    shell: bash
+jobs:
+  publish:
+    runs-on: linux-base
+    container:
+      image: git.scient.ing/infra/linux-base:26.10.7
+    timeout-minutes: 30
+    env:
+      REGISTRY: ${{ github.server_url }}/api/packages/${{ github.repository_owner }}/pypi
+    steps:
+      - name: Require a version tag
+        run: |
+          if [[ "$GITHUB_REF" != refs/tags/v* ]]; then
+            echo "Publish runs on a version tag such as v0.1.1; $GITHUB_REF is not one."
+            exit 1
+          fi
+      # The whole history, so setuptools-scm finds the tag and computes the release version.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Check the repository
+        run: pixi run --locked check
+      - name: Build the sdist and wheel
+        run: pixi run --locked -e dev dist
+      - name: Confirm the built version is the tag
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          wheels=(dist/paperspec-*.whl)
+          built="$(basename "${wheels[0]}" | cut -d- -f2)"
+          echo "tag $GITHUB_REF_NAME, built $built"
+          if [ "${#wheels[@]}" -ne 1 ] || [ "$built" != "$tag" ]; then
+            echo "The built version is not the tag's; is the tag on the commit this job checked out?"
+            exit 1
+          fi
+      - name: Check the package metadata
+        run: pixi run --locked -e dev twine check --strict dist/*
+      # --skip-existing makes a rerun on the same tag succeed instead of failing on the files already there.
+      - name: Upload to the package registry
+        env:
+          TWINE_USERNAME: ${{ secrets.PACKAGE_USER }}
+          TWINE_PASSWORD: ${{ secrets.PACKAGE_TOKEN }}
+          TWINE_REPOSITORY_URL: ${{ env.REGISTRY }}
+        run: |
+          if [ -z "$TWINE_USERNAME" ] || [ -z "$TWINE_PASSWORD" ]; then
+            echo "The secrets PACKAGE_USER and PACKAGE_TOKEN are not set; deploy/README.md says how."
+            exit 1
+          fi
+          pixi run --locked -e dev twine upload --non-interactive --skip-existing dist/*
+          echo "Published to $REGISTRY: pip install --index-url $REGISTRY/simple/ paperspec"