Consolidate release CI workflows into one

[EpicWink]

To reduce duplicate release (aka PyPI publish) jobs. This is primarily to reduce the number of Trusted Publishers required to be configured for #1169.

[Mukller]

This cleanly resolves the biggest operational blocker flagged in #1169 (comment): with publishing consolidated into a single workflow, the trusted-publisher matrix collapses from ~4 workflow filenames × 12 project/index combinations to one filename per project.

Triage note now that three PRs overlap in this area:

• This PR (Consolidate release CI workflows into one #1265) — consolidation; natural base for the migration.
• Use official action to publish package in CI #1169 (same author) — original twine → trusted-publishing migration across the four split workflows. Once this lands, its publish-job parts are superseded; anything not CI-related there can rebase on top.
• Use trusted publishing #1264 (@kohtala) — trusted publishing plus a separate orthogonal improvement (GitHub-hosted runners for ubuntu-arm64 / macOS intel & M1). The runner part could stack on top of this PR independently.

Suggest also copying the full PyPI/TestPyPI pending-publisher checklist (all four package names × both indexes) into this PR's description — whoever merges is going to be following it as the setup guide.

[kohtala]

I commented about this on #1264 (comment): It's enough to have the releases in one workflow for the trusted-publisher matrix. If I read the documentation right the projects are still identified by the environment in the OIDC token (in addition to the workflow file).

For the release, the builds need not be consolidated into the same workflow directly, but can be reused from their workflows.

[EpicWink]

@kohtala you're right, consolidating only the release jobs is sufficient. I've done this