Add Python 3.13 compatibility and modernize releases

[cotterpl]

Summary

• modernize packaging with pyproject.toml and Python 3.10–3.13 metadata
• update scientific dependencies and scikit-learn validation calls for Python 3.13
• replace pip-tools requirement snapshots with a universal, committed uv.lock
• run locked uv CI across Python 3.10–3.13 with minimum-dependency and clean-wheel checks
• add explicit multiprocessing spawn parity coverage
• add protected tag-based PyPI Trusted Publishing through GitHub OIDC
• validate exactly one wheel and one sdist, test the exact wheel, and checksum the build/publish artifact handoff
• remove local token-based PyPI uploads; keep publish_package.sh as preflight only
• keep R compatibility tests optional and unchanged

Validation

• uv lock --check
• uv run --locked python -m pytest test/ — 213 passed
• uv run --locked --extra r python -m pytest test_R/ — 10 passed
• uv run --locked python scripts/spawn_smoke.py — BATS and TBATS serial/spawn parity passed
• uv build --no-sources — wheel and sdist built
• uvx --from twine==7.0.0 twine check dist/* — passed
• clean external wheel installation and minimum-dependency environments validated
• release artifact validator passed good fixtures and rejected extra, hidden, traversal, symlink, and wrong-version fixtures

One-time release setup

Before publishing, configure the existing PyPI tbats project Trusted Publisher with owner intive-DataScience, repository tbats, workflow publish.yml, and environment pypi. Protect the GitHub pypi environment and v* tags. No PyPI token secret is required.