ci: PyPI release workflow (Trusted Publishing) (#3)

* ci: PyPI release workflow via Trusted Publishing

Publishes to PyPI on a v* tag using PyPI Trusted Publishing (OIDC) — no API token
stored. Version comes from pyproject.toml; the tag is the trigger. Requires a
one-time Trusted Publisher set up on PyPI (project isms, unidoc/isms-python,
release.yml, environment pypi).

* chore: distribution name isms-sdk for PyPI

The bare 'isms' name is rejected by PyPI's typosquat / too-similar guard, so the
published distribution is isms-sdk. The import stays 'isms' (pip install isms-sdk ->
from isms import IsmsClient, same pattern as sentry-sdk / beautifulsoup4). Updates
the README install line + an install-vs-import note, and the release workflow's
Trusted-Publisher comment (PyPI project name isms-sdk).

* ci: harden release workflow (tag/version check + test gate)

Addresses Alip's review on PR #3:
- Verify the pushed tag matches pyproject.toml's version before build/publish, so a
  mistagged release can't silently publish the wrong (and unrewritable) version.
- Add an in-workflow lint+test job and gate publish on it (needs: test) — tests.yml
  never runs on tag pushes, so this guarantees lint+tests pass on the exact tagged
  commit before anything is published.