ci: gate publishing on the release, rehearse the call path, and lint with a current zizmor

- backend-release checks the tag and the release separately and publishes
  only when it created the release in this run. A run that pushed the tag and
  then failed to create the release used to skip both on re-run.
- pypi-publish accepts a `target` from callers (default pypi) so the
  reusable-workflow path can be rehearsed against TestPyPI; the TestPyPI job
  skips files that already exist there.
- A temporary workflow, to be removed before merge, calls pypi-publish the
  way backend-release does, aimed at TestPyPI, on this pull request: PyPI
  verifies the job_workflow_ref claim, which names the called file, so the
  run proves the trusted-publishing path through workflow_call.
- zizmor-action v0.6.3: the pinned v0.5.2 bundles zizmor 1.23, which cannot
  parse the `uses: $/...` self-repository syntax and aborted the audit.

.github/workflows/zizmor.yml

@@ -22,4 +22,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3