fix(release): support Metadata 2.5 publishing

[m-szymanska]

Summary

• update the production and TestPyPI publisher action from v1.14.0 to v1.14.2, whose Twine v7 supports Core Metadata 2.5
• add a guarded manual production recovery path for an existing published, non-prerelease release tag
• document the immutable-tag recovery procedure and registry smoke requirements

Root cause

The v0.1.19 build and release verification passed, but the v1.14.0 publisher rejected the wheel before upload with:

InvalidDistribution: Invalid distribution metadata: 2.5 is not a valid metadata version

Upstream v1.14.2 explicitly adds Twine v7 support for Metadata 2.5:
https://github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2

Failed publish run:
https://github.com/vetcoders/screenscribe/actions/runs/32606828729

Recovery safety

Manual recovery:

• must be dispatched from main
• accepts only strict vMAJOR.MINOR.PATCH
• requires tag/version equality and ancestry from origin/main
• requires an existing published, non-prerelease GitHub Release
• rebuilds and re-verifies artifacts
• still requires the protected pypi environment approval

The public v0.1.19 tag is not moved, deleted, or recreated.

Verification

• actionlint .github/workflows/publish-pypi.yml .github/workflows/publish-testpypi.yml
• make verify — RESULT: READY
• commit hooks: YAML, Semgrep, detect-secrets, whitespace, merge conflicts — passed

[claude]

⚠️ Code review skipped — your organization has reached its monthly code review spending cap.

An organization admin can view or raise the cap at claude.ai/admin-settings/claude-code. The cap resets at the start of the next billing period.

Once the cap resets or is raised, reopen this pull request to trigger a review.

[Copilot]

Pull request overview

This PR updates the project’s PyPI publishing workflows to support Python Core Metadata 2.5 (via Twine v7 in pypa/gh-action-pypi-publish@v1.14.2), and adds a guarded workflow_dispatch recovery path for re-publishing an already-existing, non-prerelease release tag after a publisher-side failure. It also documents the intended recovery and post-publish verification procedure in the team release checklist.

Changes:

• Bump pypa/gh-action-pypi-publish in both TestPyPI and PyPI workflows from v1.14.0 → v1.14.2.
• Add a guarded manual (workflow_dispatch) recovery path to the production PyPI publish workflow, including GitHub Release state checks.
• Document the production publication/recovery procedure and post-publish smoke requirements.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
docs/team-workflow/release-checklist.md	Adds a PyPI publication + recovery checklist section and post-publish verification steps.
.github/workflows/publish-testpypi.yml	Updates the TestPyPI publisher action pin to v1.14.2.
.github/workflows/publish-pypi.yml	Adds guarded manual recovery publishing and updates the publisher action pin to v1.14.2.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c95317fc71

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.