ci: switch to tag-driven releases via hatch-vcs

[MarTrepodi]

Problem

The release workflow has never succeeded. It bumps the version in src/swgoh_comlink/version.py, commits it, and runs git push origin main --follow-tags. Branch protection on main rejects that push:

remote: error: GH006: Protected branch update failed for refs/heads/main.
  - Changes must be made through a pull request.
  - 10 of 10 required status checks are expected.
! [remote rejected] main -> main (protected branch hook declined)

With enforce_admins: true and PRs required, nothing can push a commit directly to main. Worse, --follow-tags succeeds in pushing the tag even when the branch push is rejected, so each failed run leaves an orphaned tag pointing at a bump commit that never landed (this happened today with v2.1.0; I deleted it).

Fix: tag-driven versioning

Derive the version from the Git tag instead of committing it, so the release never touches main.

• pyproject.toml — use hatch-vcs as the version source; write the resolved value to a git-ignored _version.py via the vcs build hook. Removed the dead [tool.semantic_release] block (it referenced the old version.py mechanism).
• version.py — read __version__ from the generated _version.py, falling back to importlib.metadata, then a sentinel for unbuilt trees.
• .gitignore — ignore the generated _version.py.
• release.yml — rewritten as build → publish → tag:
  1. Compute the next version from the latest tag + a bump input (patch/minor/major).
  2. Build with SETUPTOOLS_SCM_PRETEND_VERSION so no tag is needed yet.
  3. Publish to PyPI via trusted publishing.
  4. Only after a successful publish, create the tag + GitHub Release (gh release create --target <sha> --generate-notes). A failed run therefore never leaves an orphaned tag, and no step pushes to main.
• CONTRIBUTING.md — documents the new process.

Behavior change

The repo no longer carries a committed version string, and CHANGELOG.md is no longer regenerated into the repo on release — release notes are auto-generated into the GitHub Release body instead. The existing CHANGELOG.md remains as historical record.

Verification (local)

• hatch version resolves 2.0.8.dev7+g… from existing tags ✅
• uv sync runs the vcs build hook → generates _version.py; runtime chain (version.py → __init__ → client repr) reports the derived version ✅
• SETUPTOOLS_SCM_PRETEND_VERSION=2.1.0 hatch build produces correctly named swgoh_comlink-2.1.0.tar.gz / …-py3-none-any.whl ✅
• Full unit suite: 598 passed ✅
• ruff check src/ clean; workflow YAML parses; job graph is build → pypi-publish → tag-release ✅

After merge

Trigger the release from the Actions tab → "comlink-python release" → choose bump. It will publish to PyPI and tag vX.Y.Z on the main commit.

🤖 Generated with Claude Code