[zhangzhenghao]

Summary

• Extend the existing release workflow with an independent PyPI CPU package pipeline.
• Normalize the release tag as the Python package version and build a single source distribution carrying the pinned native sources.
• Build and test CPython 3.9–3.14 wheels from that exact source archive for Linux x86-64/ARM64, macOS ARM64 and Windows x86-64.
• Publish only after all Python builds succeed, using OIDC Trusted Publishing and the pypi environment; no API-token secret.
• Document the required PyPI publisher/environment configuration. Existing native release jobs are unchanged; unmerged GPU extras are not included.

Verification

• actionlint v1.7.12 and git diff --check: passed.
• Local Linux CPython 3.12 default sdist-to-wheel build: passed.
• Installed-wheel binding tests: 51 passed.
• twine check --strict on the source archive and wheel: passed.
• Release-version script exercised with stable, prerelease and invalid tags: passed.
• Parsed comparison confirms all existing release jobs are unchanged.
• Cross-platform release-wheel matrix and live PyPI upload have not been run; ordinary PR CI is separate from release-only publishing.

Required before first publication

Configure the PyPI clap-cpp Trusted Publisher (or pending publisher) for owner gorse-io, repository clap.cpp, workflow release.yml, environment pypi. Create the matching GitHub environment and any desired approval rules. These account-side settings are not configured by this PR.