ci(publish): gate PyPI release on test matrix passing

Previously publish.yml fired directly on release:published with zero
test dependency — a broken SDK could reach PyPI and only be recovered
by publishing a new version (PyPI versions are immutable).

Add a `test` job mirroring test.yml's Python 3.10-3.13 matrix, and
make `publish` needs: test. Same coverage a push/PR gets is now
required before bits hit PyPI.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Mlaz-code

.github/workflows/publish.yml

@@ -5,7 +5,33 @@ on:
     types: [published]
 
 jobs:
+  # Re-run the full test matrix on the tagged commit before publish.
+  # Mirrors test.yml so a tagged release gets the same coverage as
+  # a push/PR. Previously publish.yml ran zero tests — a broken SDK
+  # could reach PyPI, and PyPI versions are immutable (only super-
+  # ceded). needs: test below gates the publish job on every matrix
+  # entry passing.
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: pip install -e ".[test,pandas]"
+
+      - name: Run tests
+        run: pytest -v
+
   publish:
+    needs: test
     runs-on: ubuntu-latest
     permissions:
       id-token: write