ci: a Prepare Release workflow, so the tag and __version__ agree by construction

[CSSFrancis]

publish.yml refuses a tag that does not match de_shell.__version__ — a
guard that can only fire after the tag is pushed, when the only fix is a new
tag. This does the bump and the changelog in a PR instead, so the version the
tag has to match is the version the PR just wrote.

Run it from the Actions tab, pick a bump, review the PR it opens, merge, tag.

Same as SpyDE and anyplotlib

The flow and the input vocabulary are theirs: finalize / minor / bugfix /
major / pre-release, plus the beta checkbox, with the same refusal to guess
when you ask for a minor bump while sitting on a pre-release of the next
version. SpyDE's release pre-flights carry over too — uv lock --check and the
git-deps-pinned scan.

Three things that are de-shell's own

• PEP 440 bN pre-releases — anyplotlib's shape rather than SpyDE's semver
  -rc.N, because this is a PyPI package and pip sorts bN. The version regex
  is anchored at both ends, so 0.2.2.post1 is refused rather than silently
  read as 0.2.2 (anyplotlib's is unanchored).
• A read-back guard on the bump. SpyDE gets to use npm version, which
  errors on its own. Here the bump is a sed on de_shell/__init__.py, and
  sed is silent when its pattern misses — a silent no-op would open a release
  PR that bumps nothing and produce a tag publish.yml rejects. The step reads
  the value back and fails if it did not land.
• No --version-less towncrier. package = "de_shell" would let towncrier
  read the version itself, but that import wants the package's dependencies
  installed and this job has no other reason to install them, so the version is
  passed explicitly.

There is no download-links or docs-switcher step: this ships a wheel, not
installers or a docs site.

Checked

I pulled the embedded bump script back out of the YAML and ran it — 14 cases,
9 bumps and 5 refusals, all as expected:

current	bump	beta	result
0.2.2	bugfix		0.2.3
0.2.2	minor		0.3.0
0.2.2	major		1.0.0
0.2.2	minor	yes	0.3.0b1
0.2.2	pre-release		0.2.2b1
0.3.0b1	pre-release		0.3.0b2
0.3.0b2	finalize	yes	0.3.0 (finalize is always stable)

Refused: finalize with no bN; minor or bugfix from a beta (either would
skip 0.3.0 entirely); not.a.version; 0.2.2.post1.

Also checked: the YAML parses, the sed bump and its read-back guard work
against the real de_shell/__init__.py, and uv lock --check passes today.

Docs

The Releasing section and upcoming_changes/README.rst said the changelog was
assembled by hand — true for exactly one commit. Both now point here.