Make the publish workflow verify tag and wheel versions

[artpods56]

Context

Found while reviewing #84 for the 1.0.0 release.

.github/workflows/publish.yml accepts any v* tag and publishes after release-check, but it does not verify that the tag matches package metadata. A v1.0.0 tag can therefore build a wheel whose metadata still says another version.

At review time the release branch still declared 0.19.0, which is reasonable before closeout but makes this missing guard concrete.

How to fix

• Compare GITHUB_REF_NAME with v${ksef2.__version__} before publishing.
• Verify pyproject.toml, src/ksef2/__version__.py, changelog/release notes, and built wheel metadata agree.
• Install the exact built wheel in a clean environment.
• Smoke-test documented stable imports against the installed artifact.
• Upload only the already-verified artifact.

[R20: Verify After Signature Changes]

Acceptance criteria

• A mismatched tag and wheel version fails before any upload.
• The publish job tests the built wheel rather than only the source checkout.
• Stable imports are smoke-tested from a clean installation.
• The final 1.0.0 version and changelog update are covered by the guard.

[artpods56]

Implementation merged through #84 and its final release documentation follow-up #101. This remains open until an explicitly authorized v1.0.0 tag runs the Publish to PyPI workflow: exact-tag TEST integration, metadata/artifact verification, clean-wheel import smoke test, then PyPI upload.