ci: take the template's release, publish and gate fixes

[AlexeyShalaev]

servicewright was rendered from python-library-template before five of its fixes landed, so this takes them over by hand, in the rendered text with only the names changed.

Publish (bedrock-python/python-library-template#18). The check job now decides what gets published. The dispatch tag input is data passed through env:: it has to match the release tag pattern, exist, and point at a commit on master. A workflow_run start only counts when Release Please ran for a push. check waits for the push CI run on the released SHA and stops unless it passed, and the publish job checks out that SHA rather than the tag. id-token: write moved from the workflow to the publish job; check has contents: read and actions: read. The "Set version from release tag" step is gone: instead the tag's version has to equal the committed one, and a mismatch fails with both values.

One difference from the template: servicewright keeps its version statically in pyproject.toml (version = "0.14.0", bumped by Release Please), not in __version__.py, which reads it back from the installed metadata. So VERSION_FILE is pyproject.toml and the extraction matches ^version = "…" instead of ^__version__ = "…". pyproject.toml has exactly one such line. The comment above the step names that file too.

Attestations (bedrock-python/python-library-template#24). pypi-attestations sign runs before uv publish, so releases carry PEP 740 provenance. uv publish already ran without file arguments, so the attestation files get picked up; the comment explains why it has to stay that way.

Gate (bedrock-python/python-library-template#19). All checks passed now requires success from every job it needs. Before, a skipped job counted as passed. needs is unchanged (lint, test-unit, test-apscheduler3, test-integration). MAY_SKIP is []: none of those jobs has an if:, so none is skipped by design.

Release Please (bedrock-python/python-library-template#23). Release Please uses a token from the org's release App when RELEASE_PLEASE_APP_CLIENT_ID is set, so the release PR gets CI without a close and reopen. Until the App exists it falls back to GITHUB_TOKEN and the run says so in a warning.

Answers file (bedrock-python/python-library-template#21). .copier-answers.yml at _commit: d9d0a6f, so copier update can reach this repo. I produced it with copier copy --vcs-ref d9d0a6f gh:bedrock-python/python-library-template using this library's answers and took the file as Copier wrote it, including the line wrap of the description.

Local evidence

actionlint 1.7.12 with shellcheck 0.11 on all four workflows: clean, apart from the two known false positives about client-id on create-github-app-token@v3 (actionlint's bundled metadata predates that input).

The "Resolve the release tag" step, extracted from this branch's publish.yml with its env and run with bash -eo pipefail in a throwaway repo with a bare origin. The repo has master's real pyproject.toml (0.14.0), servicewright-v0.14.0 on that commit, and servicewright-v9.9.9 on the next one:

workflow_run, tagged servicewright-v0.14.0, pyproject.toml says 0.14.0:
    Will publish servicewright-v0.14.0 (aed0b251740dc4e5550aed0bbfe2fcfc89441834)
    exit=0  outputs: tag=servicewright-v0.14.0 sha=aed0b251740dc4e5550aed0bbfe2fcfc89441834
workflow_dispatch -f tag=servicewright-v0.14.0:
    Will publish servicewright-v0.14.0 (aed0b251740dc4e5550aed0bbfe2fcfc89441834)
    exit=0  outputs: tag=servicewright-v0.14.0 sha=aed0b251740dc4e5550aed0bbfe2fcfc89441834
workflow_run, tagged servicewright-v9.9.9, pyproject.toml says 0.14.0:
    ::error::servicewright-v9.9.9 is version 9.9.9, but pyproject.toml at 502d917ec3112e3cd265b4bd88ff36788ff69255 says '0.14.0'
    exit=1  outputs:
workflow_dispatch -f tag=servicewright-v9.9.9:
    ::error::servicewright-v9.9.9 is version 9.9.9, but pyproject.toml at 502d917ec3112e3cd265b4bd88ff36788ff69255 says '0.14.0'
    exit=1  outputs:

Not ported

• fix: cap ruff and mypy at the series the generated config was checked with python-library-template#20 (ruff/mypy caps) and docs: setup instructions match what a render contains python-library-template#22 (setup docs, NEW_LIBRARY_CHECKLIST.md) are about new renders and do not apply to an existing library.
• The rest of the ci.yml and docs.yml differences from a fresh render are servicewright's own (the APScheduler 3 job, --extra all, lint-imports, the Python matrix, newer action versions), not template fixes. docs.yml matches the render exactly.

The master-only deployment policy on the pypi environment comes from setup_repo.py, not from this file, and this repo does not have it yet (deployment_branch_policy is null). Until setup_repo.py is re-run here, a dispatch from another branch can still reach the environment, so its own copy of publish.yml would be the one deciding.