Combine CI workflows: manual trigger → Test PyPI, tags → PyPI

Modified the single CI workflow to intelligently choose publication target:
- workflow_dispatch (manual trigger) → publishes to Test PyPI
- v* tags → publishes to production PyPI
- Always runs full test suite first

This consolidates the two workflows into one, reducing duplication while
providing flexibility for testing releases before production.

Removed separate publish-test-pypi.yml workflow.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: ryan-williams

.github/workflows/ci.yml

@@ -3,9 +3,10 @@ name: CI
 on:
   push:
     branches: [main]
-    tags: ['v*.*.*']
+    tags: ['v*']
   pull_request:
     branches: [main]
+  workflow_dispatch:
 
 jobs:
   test:
@@ -34,7 +35,7 @@ jobs:
 
   publish:
     needs: test
-    if: startsWith(github.ref, 'refs/tags/v')
+    if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     permissions:
       id-token: write
@@ -54,7 +55,15 @@ jobs:
           uv pip install --system build
           python -m build
 
+      - name: Publish to Test PyPI
+        if: github.event_name == 'workflow_dispatch'
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          password: ${{ secrets.TEST_PYPI_TOKEN }}
+
       - name: Publish to PyPI
+        if: startsWith(github.ref, 'refs/tags/v')
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           password: ${{ secrets.PYPI_TOKEN }}