ci: tag-triggered PyPI release pipeline with VCS versioning

[kurodo3]

Summary

• Switches build backend to hatchling + hatch-vcs for tag-based dynamic versioning (v0.1.0 → 0.1.0)
• Adds publish.yml: tag-triggered workflow with test → build → TestPyPI (auto) → PyPI (manual approval gate)
• Uses OIDC Trusted Publishing (no secrets) and Sigstore build attestations
• Adds license-check and dependency-review jobs to ci.yml to block copyleft dependencies
• Adds pip-licenses to dev deps

Test plan

• CI passes on this PR (test matrix + license-check)
• After merge: configure GitHub environments testpypi and pypi (repo Settings → Environments)
• After merge: configure Trusted Publishers on test.pypi.org and pypi.org
• Push tag v0.1.0 — verify TestPyPI publishes automatically
• Approve PyPI deployment in GitHub UI — verify pypi.org package and GitHub Release appear