feat: publish to PyPI and hand downstream bumps to Dependabot

[zhanghanduo]

Going open source removed the premise the previous release design rested on. Closes the need for #24 — see below.

Why this replaces the mechanism from #23

Every consumer needed a credential just to resolve a private Git dependency, and opening a bump PR across repositories needed a second one — an org-level GitHub App or a cross-repo PAT, neither available without organization administration.

A public PyPI package needs none of it:

Before	Now
apodex-agent-core @ git+ssh://…@<sha>	apodex-agent-core==0.3.0
Deploy key / AGENT_CORE_REPO_TOKEN / insteadOf rewriting	nothing — public package
repository_dispatch → repin script → PR	Dependabot
GitHub App or PAT (needs org admin)	nothing — Trusted Publishing is configured on PyPI's side

.github/downstream/ is deleted entirely.

What publishing looks like

release job (unchanged gates, plus two new ones) → publish-pypi job with id-token: write scoped to that job alone, so no build-time action can request the identity PyPI trusts. No API token exists anywhere in the repo.

Two new gates, both because a PyPI version number can never be reclaimed — not by deleting the release, not by yanking:

• twine check on both artifacts;
• install the built wheel into a clean environment and import agent_core (the release contract in the README required this; it was not implemented).

Version 0.3.0, not 0.2.0

0.2.0 was never tagged or distributed — it exists only in main's history. Consumers go from Git revisions straight to the first published release. CHANGELOG marks 0.2.0 Never published rather than pretending it was a release.

Also fixes two defects that shipped in #23

1. The version gate accepted a decreasing version. It compared for inequality, not an increase, so a PR could move 0.2.0 back to 0.1.9 and pass.
2. skip-version-bump was inert. Default pull_request event types exclude labeled, so applying the label did not re-run the check — the PR stayed red forever.

The one real limitation, documented

A Dependabot PR runs CI as if it came from a fork: read-only GITHUB_TOKEN, and secrets.* resolves against Dependabot secrets, not Actions secrets. Plain test CI is unaffected; any step consuming a secret needs that secret duplicated under Settings → Secrets → Dependabot, or a guard. docs/downstream-bump.md spells this out. Worth the trade against a long-lived cross-repo credential in both products.

Packaging metadata

PEP 639 SPDX (license = "Apache-2.0" + license-files) instead of the legacy table form, which had embedded the entire Apache text into the distribution's License field. Plus classifiers and project URLs. Metadata-Version: 2.5, twine check PASSED.

Verification

• ruff clean, pyright 0 errors, 1138 passed, uv sync --frozen consistent.
• twine check PASSED on wheel and sdist; wheel confirmed to carry agent_core/py.typed and the license.
• The wheel smoke script was run locally, verbatim as it appears in the workflow — and caught a real error first: I had asserted user_msg("hi").role, but Message is a TypedDict, so constructors return plain dicts.
• Every run: script passes bash -n.
• New tests guard the invariants that would silently degrade: no PyPI token may appear, id-token must stay scoped to the publish job, twine check must run, .github/downstream/ must not return, the SPDX license must not gain a redundant License :: classifier (PyPI rejects both — after the tag exists).

Not done here

Downstream PRs ApodexHarness#524 and FrontierAgentInternal#107 install the now-deleted workflow and should be closed; they need replacing with a .github/dependabot.yml plus the switch to apodex-agent-core==0.3.0. Neither product declares AgentCore on main yet, so that belongs with whichever migration branch merges first.

Before tagging v0.3.0: register the PyPI pending publisher and create the pypi environment (docs/downstream-bump.md).