Build/pypi readiness

[gagreene]

Summary

Executes Phases 1–6 of docs/pypi-publication-readiness-plan.md (local reference doc,
not part of this diff) in preparation for the first public PyPI release of
flame-components as v0.1.1. Covers release policy, documentation, package metadata,
CI compatibility, build-artifact verification, and a secure publishing workflow.

Full test suite: 114/114 passing throughout.

Breaking changes (pre-1.0, no PyPI release exists yet)

• Removed the 7 deprecated camelCase aliases (getMidFlameWS, getFlameLength,
  getFlameHeight, getFlameTilt, getFlameResidenceTime, getFlameDepth,
  flameComponent_ArrayMultiprocessing) entirely, rather than carrying them through a
  deprecation cycle. The package has never been published and has no known external
  consumers of the camelCase names, so there's nothing to protect.
• Raised the supported Python floor to >=3.11 (from >=3.9) — a deliberate choice
  to stop carrying 3.9/3.10.
• Raised the numpy floor to >=1.23.2 (from >=1.20) to match — the oldest numpy
  release with Python 3.11 wheels. Validated directly (not inferred) on the actual floor
  and multiple newer versions; still unbounded above.

Phase 1 — Release policy and package identity

• Decided and validated the Python/numpy floors above.
• Decided to remove (not deprecate) the camelCase aliases; done.
• Recorded the release tag decision: v0.1.1 (not re-pointing v0.1.0, since packaging
  changes already merged after that tag).

Phase 2 — Project documentation

• Rewrote docs/CODEBASE.md against the current src/ layout, snake_case-only API, and
  removed stale references to fixed bugs and the unshipped ArcGIS variant.
• Expanded README.md: distribution-vs-import-name note, a verified self-contained/
  executable multiprocessing example, an API Reference section for all 7 public
  functions, a Scientific References section, and a Support/Issue-Reporting section.
• Added CITATION.cff.

Phase 3 — Package metadata

• Added [project.urls] (Homepage, Source, Issue Tracker, Release Notes, Documentation).
• Added Python version classifiers only for versions actually verified this effort
  (3.11–3.14), plus Development Status / Intended Audience classifiers.
• Modernized license metadata to SPDX (license = "MIT" + license-files), dropping the
  now-redundant classifier. Verified via a real build: License-Expression: MIT, twine check passes.
• Confirmed exactly one runtime dependency (numpy); pytest remains test-only.

Phase 4 — CI compatibility and quality gates

• Replaced the single ubuntu/py3.12 test job with a matrix: Python 3.11/3.12/3.13/3.14 on
  ubuntu-latest, plus a Windows + Python 3.12 leg (multiprocessing coverage).
• Added a minimum-dependency job pinning Python 3.11 + numpy==1.23.2 exactly, with a
  version-assert step.
• All jobs run with -W error (unexpected warnings fail the build).
• Added scripts/smoke_test.py: a standalone script that only imports the installed
  package (no repo import) and exercises __version__, __all__, and one scalar/array/
  multiprocessing call each. Runs in every CI job and is reused by the release workflow.
• Bumped astral-sh/setup-uv and actions/checkout to current major versions.

Phase 5 — Build and artifact verification

• Built from a genuinely clean clone (not the working directory); twine check passes on
  both the wheel and sdist.
• Full content-listing inspection of both artifacts against the expected
  include/exclude list.
• Built a wheel from an independently re-extracted copy of the sdist and confirmed it's
  byte-for-byte identical (SHA-256 per file) to the directly-built wheel.
• Installed the wheel and the sdist into two separate clean environments and ran the
  smoke test in each, outside the repo.
• Found and fixed a real issue: the README's License link was relative
  ([LICENSE](LICENSE)), which PyPI isn't guaranteed to resolve correctly under modern
  [project.urls] metadata. Changed to an absolute GitHub URL.

Phase 6 — Secure publishing

• Added .github/workflows/release.yml: triggers only on a human-published GitHub
  Release (never a bare tag push). An isolated build job runs the full suite, builds
  and validates distributions, installs the built wheel into a fresh environment and
  smoke-tests it, then attaches the exact files to the GitHub Release. Separate
  publish-testpypi/publish-pypi jobs (gated by the Release's prerelease flag) download
  that same artifact and publish via pypa/gh-action-pypi-publish using OIDC Trusted
  Publishing — no long-lived API token. id-token: write is scoped to only those two jobs.
• Added docs/RELEASING.md: the ongoing release procedure, one-time setup steps, and
  recovery guidance (PyPI releases can't be replaced — yank or ship a new version).

Not yet done (needs repo/account access this session doesn't have):

• Creating the pypi/testpypi GitHub environments (with a required reviewer on pypi).
• Registering a pending Trusted Publisher on pypi.org and test.pypi.org for this repo,
  workflow release.yml, matching environment names.
• Branch-protecting master to require the Tests workflow.

These are spelled out in docs/RELEASING.md's "One-time setup" section and need to happen
before release.yml can succeed — GitHub only recognizes release-triggered workflows
from the default branch, so this also couldn't be rehearsed before this merge.

Not in this PR

Phases 7–9 (TestPyPI rehearsal, production release, FuelAnalyst downstream adoption) are
next, after the account-side setup above and this merge.

Test plan

• uv run pytest tests/ -v — 114/114 pass
• uv build + twine check dist/* — both artifacts pass
• Wheel and sdist each installed into a clean environment and smoke-tested
  independently of the source tree
• Release workflow YAML validated for syntax and least-privilege permissions
  (not yet executed end-to-end — blocked on the account-side setup above)