[codex] Harden release publish workflow

[ZenulAbidin]

Summary

• add a manual dry-run path for the PyPI release workflow
• validate that the GitHub release tag matches the package version before publish
• modernize the workflow action versions and run a metadata check before upload

Testing

• python -m build
• python -m twine check dist/*
• gh workflow run 57608610 --ref codex/fix-github-actions-workflow -f publish=false
• gh run watch 24629114961 --exit-status

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.39%. Comparing base (14ef101) to head (253eab9).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master      #17   +/-   ##
=======================================
  Coverage   66.39%   66.39%           
=======================================
  Files         135      135           
  Lines        5008     5008           
  Branches      754      754           
=======================================
  Hits         3325     3325           
  Misses       1425     1425           
  Partials      258      258           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.