fix(ci): repair lint gate, consolidate CI/CD workflows, PyPI trusted publishing

[ejoliet]

Summary

CI was failing on every run. Root cause = lint, not workflow config: make lint runs ruff then mypy --strict; ruff exited first with 5 errors, with 16 mypy errors behind it. Tests already passed. This repairs the lint gate and consolidates CI/CD to the two workflows requested.

CI green

• ruff check src tests → All checks passed
• python -m mypy src → Success, 19 files
• make test → 88 passed, 3 skipped

Lint fixes (5 ruff + 16 mypy → 0)

• ruff: datetime.UTC (UP017), drop unused imports (F401), dedup mock_aws (F811)
• BaseReader.read Protocol: add deep + **_kwargs (fixes quicklook call-arg; impls already had them)
• mypy overrides: add bare astropy + astropy.* + asdf (glob alone misses the bare package)
• asdf._to_plain: cast tree, getattr tag, drop stale type: ignore — AIDEV anchors + no-__iter__ recursion-bomb invariant preserved
• streams.readinto: # type: ignore[override] (deliberately narrow, zero new dep)
• browser: None guard before int(row_key.value); async def action_back

Workflows (one CI, one release)

• ci.yml: PR + push to main only (dropped claude/**), permissions: contents:read, ubuntu 3.11+3.12 full lint+test, macos 3.12 test-only (pyperclip pbcopy/xclip divergence on the core macOS user base)
• release.yml: trigger on release: published; build → publish-pypi via OIDC Trusted Publishing with mandatory download-artifact (old file omitted it → would publish empty); non-blocking TestPyPI dry-run off the critical path
• docs/releasing.md: PyPI Trusted Publisher (OIDC) setup with exact-match table + version-burn rollback note

Action required after merge (one-time, manual)

PyPI Trusted Publisher must be registered before first release — see docs/releasing.md:
owner ejoliet, repo s3peek, workflow filename release.yml, environment pypi (+ testpypi). Create matching GitHub Environments. No API token stored.

Planned + reviewed via consensus (Architect + Critic), executed by a 2-agent team.

🤖 Generated with Claude Code