Harden release verification and PyPI publishing flow

[devgamesan]

Context

.github/workflows/release.yml already builds distributions, publishes to TestPyPI, verifies installation, publishes to PyPI, and creates a GitHub Release. Before v1.0, the release flow should be validated end to end and any token/publishing risks reduced.

Tasks

• Run a pre-v1.0 TestPyPI release and verify uv tool install works.
• Verify git-ssh-sync --version and git-ssh-sync --help from the installed package.
• Confirm PyPI/TestPyPI credentials or Trusted Publishing configuration.
• Consider switching from API tokens to Trusted Publishing if practical.
• Document the exact v1.0 release procedure.

Acceptance Criteria

• TestPyPI installation of the release candidate succeeds.
• Installed CLI reports the expected version.
• The release procedure is documented and reproducible.
• Required GitHub secrets/environments are listed or Trusted Publishing is configured.