Harden PyPI and GitHub release trust

[ChelseaKR]

Summary

• Splits authorization, exact-commit verification/build, and checkout-free PyPI/GitHub publication with last-mile tag checks.
• pins the maintainer SSH signer in the repository
• documents the release-boundary change in the changelog

Validation

• portfolio conformance release_workflow: PASS
• actionlint: PASS
• zizmor offline, medium+ findings: none
• YAML parse and git diff --check: PASS

[ChelseaKR]

MERGE-READY — draft — user must mark ready & merge. Verified 2026-07-31 at head c8f5b6e.

CI evidence: all 15 checks pass at c8f5b6e (run 30672798xxx series; e.g. accessibility, test (3.11/3.12/3.13), audit, secrets, zizmor, semgrep, CodeQL ×2 — gh pr checks 79 all green). MERGEABLE, based on current main (6f90ee5, 0 behind), merges clean via git merge-tree.

Does not itself trigger a release: the diff removes the release: published trigger from pypi-publish.yml; the only remaining entry point is workflow_dispatch with a required existing signed stable tag, gated by the authorize job (dispatch must come from main at its current head; tag must be an annotated tag object, SemVer-stable, an ancestor of main, and SSH-signature-verified against .github/allowed_signers, which already exists on main with the maintainer key). Merging changes YAML only — nothing publishes until a human signs and pushes a tag and dispatches the workflow.

Remediations pushed on this branch:

• 6822cff — closed a real gap in the new flow: the GitHub release is now created by the workflow's own GITHUB_TOKEN, and token-raised events do not trigger other workflows, so docker.yml and release-corpus.yml would silently never run for a release. docker.yml already supported dispatch-with-tag; release-corpus.yml now has the same tag input (verify at the tag, build the tag's tree, upload), and the release checklist in docs/roadmap.md + the CHANGELOG entry document the new dispatch sequence.
• c8f5b6e — lockfile-only npm audit fix for GHSA-mh99-v99m-4gvg (brace-expansion <1.1.17, published 2026-07-31), which had started failing the blocking npm audit --audit-level=high step in make a11y on any fresh CI run, including this branch's. Unrelated to this PR's changes; main inherits the fix on merge.

Local gates at c8f5b6e: ruff check/format, mypy, pytest (589 passed, 91.64% ≥ 90% coverage), docs-check, contract-check, i18n-check, pip-audit (clean), gitleaks (clean), make a11y (pa11y-ci, both surfaces, 0 errors), actionlint + zizmor offline (0 findings) on the changed workflows.

Hold note: merging this PR is safe under the v0.9.0 hold — the v0.9.0 release itself remains held on upstream MobilityData/transit-operational-data-standard#156 (verified still OPEN today). Do not tag or dispatch a release; the first live exercise of this hardened flow should wait for the hold to clear, and release tags are human-only.