feat: add ci and release-please workflows

[moc-guardian]

Automated CI/CD + PyPI publishing (release-please)

This PR wires up the same release flow we use in cepx:

• CI (.github/workflows/ci.yml) — runs the test suite on every push to main and every PR, across macOS/Ubuntu/Windows × Python 3.9–3.14.
• Release (.github/workflows/release-please.yml) — release-please reads Conventional Commits, keeps an open "release PR" with the next version + changelog, and on merge it tags the release and auto-publishes to PyPI via Trusted Publishing.

The old tag-triggered publish.yml was removed — release-please now owns tagging and publishing.

---

⚠️ Required manual setup

The workflows will not publish until these one-time steps are done. Please complete them before/after merging.

1. Create the pypi GitHub environment

1. Repo → Settings → Environments → New environment
2. Name it exactly pypi
3. Save. (No secrets needed — publishing uses OIDC, not tokens.)

2. Configure PyPI Trusted Publishing

1. Log in to PyPI as the jsonshift project owner.
2. Go to the project → Manage → Publishing → Add a new pending/trusted publisher (GitHub Actions).
3. Fill in exactly:
   • PyPI Project Name: jsonshift
   • Owner: pml-guardian
   • Repository name: jsonshift
   • Workflow name: release-please.yml
   • Environment name: pypi
4. Save.

3. Allow GitHub Actions to open PRs

Release-please needs to create/update the release PR:

1. Repo → Settings → Actions → General
2. Under Workflow permissions, enable "Allow GitHub Actions to create and approve pull requests"
3. Save.

---

How it works after setup

1. Merge normal PRs to main using Conventional Commits (feat:, fix:, feat(mapper):, etc.) — the history already follows this.
2. release-please automatically opens/updates a "chore: release X.Y.Z" PR with the bumped version and CHANGELOG.md.
3. Merge that release PR → it tags the version, creates the GitHub Release, and publishes to PyPI automatically.

No manual version bumps or twine upload needed.

Note: the current version is seeded at 3.5.0 in .release-please-manifest.json. The first release PR will bump from there based on the commits since.