ci(release): three fixes after the first v0.1.0 attempt

Three blockers surfaced when the first tag actually ran the pipeline:

1. PyPI sdist build refused the `readme = "../../README.md"` path
   in bindings/python/pyproject.toml. maturin sdist forbids `..`
   inside archive entries. Solution: add a Python-specific README at
   bindings/python/README.md (covers the Python install + pointers to
   the main repo) and point the project.readme key at the local file.

2. Node publish job hit ENOENT on npm/<platform>/wickra.<...>.node
   because napi's per-platform scaffolding directories did not exist
   yet when `napi artifacts` ran. Insert `napi create-npm-dirs` as
   its own step before `napi artifacts` so the platform package layout
   is in place before binaries get moved into it.

3. and 4. (crates.io email + npm 2FA-bypass) are registry-side account
   settings that have to be done in the user's browser; no code change
   needed for those. They'll be sorted before the next tag push.

bindings/python/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "maturin"
 name = "wickra"
 version = "0.1.0"
 description = "Streaming-first technical indicators: incremental, fast, install-free."
-readme = "../../README.md"
+readme = "README.md"
 license = { text = "PolyForm-Noncommercial-1.0.0" }
 requires-python = ">=3.9"
 keywords = ["finance", "trading", "indicators", "technical-analysis", "ta-lib"]