Makefile: add PyPI publish and release targets

[dannywillems]

Summary

• Add make build to build the package with Poetry
• Add make publish-dry-run to preview what would be published
• Add make publish to publish to PyPI, create a git tag (vX.Y.Z), and create a GitHub release with the dist artifacts
• Add make clean-dist to clean distribution artifacts
• Version is extracted automatically from pyproject.toml

Test plan

• Run make publish-dry-run and verify it shows version, tag, and package contents without side effects
• Run make build and verify dist/ contains the expected .tar.gz and .whl files

[Copilot]

Pull request overview

Adds release-oriented Makefile targets to build and publish the Python package via Poetry, including PyPI publishing and GitHub release creation, with version derived from pyproject.toml.

Changes:

• Extract package version in Makefile for use in release/publish commands.
• Add build, publish-dry-run, publish, and clean-dist targets.
• Update clean to also remove dist/ artifacts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

VERSION is extracted by grepping/parsing pyproject.toml, which is brittle (format changes, whitespace, switching between [tool.poetry] vs PEP 621 [project], etc.). Since this Makefile already depends on Poetry, prefer deriving the version via poetry version -s (or a small python -c using tomllib) so the value matches what Poetry will actually build/publish.

Suggested change

	VERSION := $(shell \
	grep '^version' pyproject.toml | head -1 | \
	sed 's/.*"\(.*\)"/\1/')
	VERSION := $(shell poetry version -s)

[Copilot]

publish-dry-run depends on build, but poetry publish --dry-run will typically build again unless --no-build is provided. Consider adding --no-build here to avoid redundant builds and ensure the dry-run output reflects the artifacts currently in dist/.

Suggested change

	poetry publish --dry-run
	poetry publish --dry-run --no-build

[Copilot]

publish depends on build, but poetry publish will typically rebuild unless --no-build is used. Adding --no-build makes the target faster and ensures the PyPI upload and the dist/* artifacts attached to the GitHub release are based on the same already-built output.

[Copilot]

As written, poetry publish happens before any checks that the git tag can be created/pushed or that gh is authenticated. If the tag already exists (or gh release create fails), you can end up with a PyPI release without the corresponding tag/GitHub release. Consider adding preflight checks (e.g., fail if tag v$(VERSION) exists, ensure clean working tree, verify gh auth status) before publishing so failures happen before the irreversible step.