Prepare tbats 1.2.0 release

[cotterpl]

Summary

• bump package version from 1.1.3 to 1.2.0
• publish to PyPI only when a visible GitHub Release is published
• check out the release event's exact tag and bind it to the event commit
• require the release commit to belong to master
• keep the existing exact artifact, checksum, clean-wheel, and OIDC protections
• update local preflight and release documentation

Validation

• uv lock --check
• uv run --locked python -m pytest test/ — 213 passed
• uv run --locked --extra r python -m pytest test_R/ — 10 passed
• built wheel and sdist validated as version 1.2.0
• workflow YAML and shell syntax checks passed
• focused release-trigger security review passed after binding the fetched tag target to the release event SHA

Release flow after merge

1. Ensure the PyPI Trusted Publisher and protected GitHub pypi environment are configured.
2. Wait for green CI on master.
3. Create and push signed tag v1.2.0.
4. Publish a GitHub Release for that existing tag.
5. The release.published workflow validates and publishes the exact artifacts to PyPI through OIDC.