Automate version bumps and PyPI publishes from main

[manish-wekan]

Summary

• After a non-release PR merges to main, bump-version.yml opens (or refreshes) a chore(release): X.Y.Z PR that sets the same version in pyproject.toml and uv.lock.
• The bump is max(git, PyPI) + patch (so today's git 0.3.2 + PyPI 0.3.5 becomes 0.3.6). Unpublished git versions are left alone so the loop does not double-bump.
• Merging that release-labeled PR pushes main with a version PyPI does not have; publish.yml builds, trusted-publishes, and tags vX.Y.Z. Ordinary feature merges skip the protected pypi environment.

One-time setup (required before the first automated upload)

• GitHub repo: Settings → Environments → create pypi (optional required reviewers).
• GitHub repo: Settings → Actions → General → allow Actions to create pull requests.
• PyPI: trusted publisher for nitrocloudofficial/nitrostack-python-sdk, workflow publish.yml, environment pypi.

Test plan

• pytest tests/test_bump_version.py
• Merge this PR to main, then merge any other feature PR and confirm a release/0.3.6 PR appears
• Merge the release PR and confirm PyPI gets 0.3.6 plus git tag v0.3.6
• Manual minor/major: Actions → Bump version → Run workflow