Publish ContextMesh 0.1.1 to PyPI via Trusted Publishing

[Deep-Sixed]

Scope

Release engineering only. This PR prepares the first PyPI publication under the corrected distribution name contextmesh-graph.

Changes

• Bump the distribution version from 0.1.0 to 0.1.1.
• Add .github/workflows/publish.yml for PyPI Trusted Publishing through GitHub OIDC.
• Keep the publishing job isolated: it only downloads previously built distributions and invokes pypa/gh-action-pypi-publish@release/v1 with id-token: write in the pypi environment.
• Trigger publication only when a GitHub Release is published.
• Fail closed unless the GitHub release tag exactly matches v<project.version> and the distribution name is exactly contextmesh-graph.
• Build one wheel and one sdist, run twine check, and verify the expected contextmesh_graph-0.1.1 artifact names before publication.
• Add v0.1.1 release notes and correct the install command to contextmesh-graph / contextmesh-graph[mcp].

Authority boundary

No PyPI password or long-lived API token is stored in GitHub. PyPI is configured to trust only:

• owner: Deep-Sixed
• repository: ContextMesh
• workflow: publish.yml
• environment: pypi

The existing v0.1.0 tag is not moved or republished; it still contains the pre-rename contextmesh distribution metadata. The first PyPI release is therefore contextmesh-graph 0.1.1.

Merge / release gate

Do not create or publish the v0.1.1 GitHub Release until CI, LLM provider contracts, and the release-candidate gate are green on this PR and the merged main commit is verified.