fix: replace hatch build with python -m build; remove duplicate _data force-include

hatch build fails on GitHub Actions due to virtualenv compatibility.
python -m build (PEP 517 standard frontend) works with any build backend.
Also remove redundant force-include that duplicated _data files in the wheel.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: apundhir

.github/workflows/release.yml

@@ -5,7 +5,7 @@ on:
     tags: ["v*.*.*"]
 
 permissions:
-  id-token: write    # PyPI OIDC trusted publishing (includes Sigstore provenance)
+  id-token: write    # PyPI OIDC trusted publishing
   contents: write    # GitHub Release creation
   attestations: write
 
@@ -21,20 +21,21 @@ jobs:
         with:
           python-version: "3.11"
 
-      - name: Install build tools
-        run: pip install hatch pip-audit bandit
-
-      - name: Security gates
+      - name: Install dev dependencies + build frontend
         run: |
+          pip install build pip-audit bandit
           pip install -e ".[dev]"
+
+      - name: Security gates (advisory)
+        run: |
           bandit -ll -r src/ --exit-zero
           pip-audit --strict || true
 
       - name: Run full test suite
         run: pytest --cov
 
       - name: Build wheel + sdist
-        run: hatch build
+        run: python -m build
 
       - name: List built artifacts
         run: ls -lh dist/

pyproject.toml

@@ -75,9 +75,6 @@ traceforge        = "riskforge.adapters.traceforge:TraceForgeAdapter"
 [tool.hatch.build.targets.wheel]
 packages = ["src/riskforge"]
 
-[tool.hatch.build.targets.wheel.force-include]
-"src/riskforge/_data" = "riskforge/_data"
-
 [tool.ruff]
 line-length = 100
 target-version = "py311"