Repair Metadata 2.5 PyPI publishing (#12)

* ci: publish Metadata 2.5 distributions with uv

* ci: preserve provenance in release recovery

Author: emeisazam

.github/workflows/python-release.yml

@@ -4,6 +4,11 @@ on:
   push:
     tags:
       - "v*"
+  workflow_dispatch:
+    inputs:
+      release_ref:
+        description: Existing release tag to rebuild and publish
+        required: true
 
 permissions:
   contents: read
@@ -16,6 +21,8 @@ jobs:
       - name: Checkout Oída
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_ref || github.ref_name }}
+          fetch-depth: 0
           path: oida
 
       - name: Checkout AKOÚŌ contract
@@ -42,12 +49,20 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
+          version: "0.12.3"
           python-version: "3.12"
 
       - name: Verify release tag and project version
         working-directory: oida
+        env:
+          RELEASE_REF: ${{ github.event_name == 'workflow_dispatch' && inputs.release_ref || github.ref_name }}
         run: |
-          release_version="${GITHUB_REF_NAME#v}"
+          case "$RELEASE_REF" in
+            v*) ;;
+            *) echo "release_ref must name a v-prefixed release tag" >&2; exit 1 ;;
+          esac
+          test "$(git describe --tags --exact-match HEAD)" = "$RELEASE_REF"
+          release_version="${RELEASE_REF#v}"
           project_version="$(uv version --short)"
           test "$release_version" = "$project_version"
 
@@ -110,10 +125,12 @@ jobs:
           path: release
 
       - name: Publish ${{ matrix.project }}
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           packages-dir: release/${{ matrix.directory }}
           skip-existing: true
+          verify-metadata: true
+          attestations: true
 
   publish-oida:
     name: Publish sonicfield-oida to PyPI
@@ -134,7 +151,9 @@ jobs:
           path: release
 
       - name: Publish sonicfield-oida
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           packages-dir: release/oida
           skip-existing: true
+          verify-metadata: true
+          attestations: true