ci: manual PyPI release and dependency submission

[antoinebou12]

Summary

• Publish / PyPI: Release workflow now runs only on workflow_dispatch with a required ref (existing semver tag). Pushing a tag no longer publishes to PyPI. See workflow comments for the push-tag then run workflow steps.
• Dependency graph: Add dependency-submission.yml with \contents: write\ / \id-token: write, resilient submission step, and stashed root
  equirements.txt\ for a smaller PipReport snapshot.
• Docs extra: \mkdocs-material>=9.7.0\ in \pyproject.toml\ to align with pinned docs requirements.

Verification

• \python -m build\ succeeded locally (Windows).
• 131 tests passed in Docker (\python:3.12-bookworm) with \pip install -r requirements.txt\ and \pip install -e ., matching CI-style Linux environment.
• Host Python could not run pytest (NumPy 2 / SciPy ABI mismatch in the global Anaconda install); Docker run confirms the tree is sound.

Made with Cursor