Rework the release workflow with a tag-version check, a TestPyPI dry run and a GitHub release

[avgvi]

Replaces the upstream release.yml, which built on a v* tag and published straight to PyPI.

• build and check: on a tag, fails unless the tag equals v plus diskcache.__version__ (read from diskcache/__init__.py without importing it); builds the sdist and wheel; twine check --strict; installs the wheel in a fresh venv and imports it with -W error; uploads dist/ as an artifact.
• publish to TestPyPI (dry run): runs only on workflow_dispatch, behind the testpypi environment, with trusted publishing.
• publish to PyPI: runs only on a tag, behind the pypi environment, with trusted publishing and attestations.
• GitHub release: after the PyPI publish, creates the release for the tag with that version's section of CHANGELOG.md as the notes and the distributions attached, using the workflow token with contents: write on that job only.

Nothing runs until a tag is pushed or a dispatch is triggered. Before the first release, the pypi and testpypi environments need their required reviewer, the pending publishers must exist on PyPI and TestPyPI (project diskcache-community, owner secondwindoss, workflow release.yml, matching environment names), and pypa/gh-action-pypi-publish@* must be added to the repository's Actions allow-list, which is deliberately limited to GitHub-owned actions today.

Validated locally: the YAML parses, the version regex finds 5.6.3, and the changelog extraction falls back to a pointer when the version section does not exist yet.