Add PyPI/TestPyPI build and publication validation workflow for base_cli

[codeforester]

Goal

Add a guarded build, validation, and publication workflow for the base_cli distribution.

Background

The supplied review found no workflow that builds a Python artifact, runs twine check, validates a clean wheel install, or publishes to TestPyPI/PyPI. The existing workflows run the monorepo test suite and are not package-release gates.

Depends on #1742 and #1743 being complete enough to produce and validate a clean artifact.

Scope

• Add a focused GitHub Actions workflow for package changes and release tags.
• Build both sdist and wheel with python -m build.
• Run twine check and inspect/install the wheel in a clean environment.
• Verify package name, version, license metadata, README/package data, py.typed, and a minimal import/command smoke test in CI.
• Add a protected, explicit TestPyPI rehearsal path and a protected PyPI publication path; do not publish from arbitrary pull requests or branches.
• Document the version/tag/release sequence, required environments/secrets or trusted publishing configuration, and the recovery path for a failed publication.

Acceptance Criteria

• Pull requests touching lib/python/base_cli, packaging metadata, or release workflow build and validate the artifacts without publishing.
• A release tag or explicitly approved workflow can publish to TestPyPI and PyPI only after the artifact checks pass.
• The workflow fails on version mismatch, invalid metadata, missing py.typed/license data, install/import failure, or package-test boundary regressions.
• The published artifact is built once from the reviewed commit and the exact artifact is used for the publication step.
• Release documentation identifies the supported Python versions and provides a reproducible post-publish install/version smoke test.

Validation

• Exercise the workflow on a non-publishing branch or workflow run.
• Rehearse the TestPyPI path with a disposable release version or approved test project.
• Verify a clean pip install and base_cli.__version__ check from the resulting index artifact.
• Validate workflow YAML and run the repository's workflow contract tests.

Non-Goals

• Do not publish a production release while the package-name/license decision is unresolved.
• Do not bypass protected environments, review gates, or repository release policy.
• Do not replace the existing full Base monorepo CI gate.

Project Fields

• Priority: P1
• Size: M
• Area: CI
• Initiative: Adoption Polish

Agent Assignment

Human first for release credentials and protection policy; workflow implementation can follow the package contract.

[codeforester]

Implementation is underway in the standalone repository: basefoundry/base-cli#2. The draft PR adds one reviewed artifact build, twine/package-data validation, clean Python 3.10-3.14 install smoke tests, protected TestPyPI/PyPI paths, and release documentation.

[codeforester]

The draft PR is now green: build/metadata validation, twine check, and clean-wheel install smoke tests pass on Python 3.10 through 3.14. The PR remains draft pending review and protected-environment setup; no publication has occurred.

[codeforester]

The publication workflow is now fully validated. PR #2 and follow-up PR #4 are merged; the corrected TestPyPI rehearsal passed build, artifact validation, twine checks, and Python 3.10-3.14 smoke tests. base-cli==0.1.0 is published on TestPyPI and installs cleanly with base_cli.__version__ == "0.1.0": https://github.com/basefoundry/base-cli/actions/runs/30496622318. Closing this issue as complete. Production PyPI remains intentionally gated for a separately approved release.