Repair Metadata 2.5 PyPI publishing

[emeisazam]

Summary

• update the official PyPA publisher from v1.14.0 to immutable v1.14.2, whose Twine 7 runtime supports Core Metadata 2.5
• retain OIDC trusted publishing, per-package environments, metadata verification, and automatic PEP 740 attestations
• add an explicit manual recovery path that rebuilds an existing release tag while the workflow itself runs from reviewed main
• verify a recovery ref is a v-prefixed exact tag whose project version matches the tag
• pin the build's uv executable to 0.12.3

Why

The v0.10.0 build and independent Twine 7 verification succeeded, but the previously pinned publishing action bundled Twine 6.1 and rejected valid Core Metadata 2.5 before any upload. All four proposed PyPI versions remain unoccupied.

Validation

• the v1.14.2 annotated upstream tag peels to the pinned commit and its release specifically adds Metadata 2.5 support
• all eight verified v0.10.0 distributions contain the intended names, versions, and valid Core Metadata 2.5
• workflow YAML parses successfully; git diff --check and targeted Gitleaks scans pass
• no source tag is moved or replaced; recovery explicitly checks out and verifies the existing v0.10.0 tag