ci(core): two-tier CI + release scaffold (XWING-2207)

[Kyl-Bempah]

Adds the CI and release pipeline for traust-core

ci.yml (PR + push to main):

• lint
• test on Python 3.11/3.12
• postgres runs make test-integration against a postgres:16 service
• api-check is a no-op until XWING-2208 adds the griffe target (and a first release tag to diff against), then it activates automatically

release.yml (manual):

• self-versioned: VERSION is kept equal to pyproject; release.py does test → uv build → tag vX.Y.Z
• make bump patch|minor|major to bump the version in a PR
• push is an opt-in dispatch input; wheel + sdist uploaded as artifacts
• no package index — consumers pin the git tag/rev, same as the rest of the stack

Verified locally: make lint clean, make test 191 passed / 18 deselected (those 18 are the Postgres job), make status → traust-core 0.1.0.

AC status:

• feat(core): traust-core v1 platform API #1 ✅ code on main, green
• feat(contracts): normalize enum registry values on read #2 ⚠️ workflow done, needs branch protection + api-check (XWING-2208)
• ci(core): two-tier CI + release scaffold (XWING-2207) #3 ✅ self-versioned, tag-based release done
• refactor(core): organise by role; stub domain services and repositories #4 ❌ components.md (traust repo)
• #5 ❌ Konflux follow-up

Still needed:

• enable branch protection (lint / test / postgres required to merge)
• components.md rows (core releases first)
• Konflux enablement

Note: the postgres job is currently red on a separate, pre-existing traust-core bug (a literal % in storage/v1 DDL comments breaks apply_schema under psycopg) — fixed separately, not part of this PR.