ci(python): PyPI release workflow via Trusted Publishing; bump Rust crate to 1.0.0

- python-release.yml publishes python/ (open-ontologies-lite) to PyPI on py-v*
  tags using OIDC Trusted Publishing (no stored token)
- Rust crate 0.1.11 -> 1.0.0 for the first stable dual-stack release

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: fabio-rovai

.github/workflows/python-release.yml

@@ -0,0 +1,46 @@
+name: Python Release
+
+# Publishes the python/ bridge (open-ontologies-lite) to PyPI on a py-v* tag,
+# e.g. `git tag py-v0.1.1 && git push origin py-v0.1.1`.
+#
+# Uses PyPI Trusted Publishing (OIDC): no API token is stored. Configure once at
+# https://pypi.org/manage/project/open-ontologies-lite/settings/publishing/
+#   Owner: fabio-rovai | Repo: open-ontologies
+#   Workflow: python-release.yml | Environment: pypi
+on:
+  push:
+    tags: ['py-v*']
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - name: Build wheel + sdist
+        working-directory: python
+        run: uv build
+      - name: Check metadata
+        working-directory: python
+        run: uvx twine check dist/*
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: python/dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write          # OIDC token for Trusted Publishing; no secret needed
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "open-ontologies"
-version = "0.1.11"
+version = "1.0.0"
 edition = "2024"
 description = "AI-native ontology engine — standalone MCP server"
 license = "MIT"