Separate manual release workflow from CI (#2)

* Separate manual release workflow from CI

* Refactor release workflow with granular job separation

Split release process into distinct jobs (build, github-release, publish-to-pypi)
for better separation of concerns and permission management. Remove workflow_dispatch
inputs from release workflow and update CI workflow to use read-only permissions for
calling the release workflow.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

* Use OIDC instead of the API token for PyPI

* Update .github/workflows/release.yml

* Rename .github/workflows/claude-code.yml to .github/workflows/claude.yml

* Fix permissions

* Refactor .github/workflows/claude.yml

---------

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -19,7 +19,6 @@ on:
         options:
           - lint-and-test
           - docs-deploy
-          - release
         description: Choose the workflow to run
         default: lint-and-test
 permissions:
@@ -54,10 +53,7 @@ jobs:
   python-docs-deploy:
     if: >
       github.event_name == 'push'
-      || (
-        github.event_name == 'workflow_dispatch'
-        && (inputs.workflow == 'docs-deploy' || inputs.workflow == 'release')
-      )
+      || (github.event_name == 'workflow_dispatch' && inputs.workflow == 'docs-deploy')
     permissions:
       contents: write
     uses: dceoy/gh-actions-for-devops/.github/workflows/python-package-mkdocs-gh-deploy.yml@main  # zizmor: ignore[unpinned-uses]
@@ -69,19 +65,15 @@ jobs:
   python-package-release:
     if: >
       github.event_name == 'push'
-      || (
-        github.event_name == 'workflow_dispatch'
-        && (inputs.workflow == 'release' || inputs.workflow == 'lint-and-test')
-      )
+      || (github.event_name == 'workflow_dispatch' && inputs.workflow == 'lint-and-test')
     permissions:
       contents: write
       id-token: write
     uses: dceoy/gh-actions-for-devops/.github/workflows/python-package-release-on-pypi-and-github.yml@main  # zizmor: ignore[unpinned-uses]
     with:
       package-path: .
-      create-releases: ${{ github.event_name == 'workflow_dispatch' && inputs.workflow == 'release' }}
+      create-releases: false
     secrets:
-      PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   dependabot-auto-merge:
     if: >