chore(release): PyPI publishing setup

[imran-siddique]

Sets up OIDC trusted publishing to PyPI via GitHub Actions. Requires configuring the `pypi` environment in repo settings and registering the trusted publisher on PyPI.

Changes

• pyproject.toml: Added `authors`, `keywords`, and `[project.urls]` (Homepage, Repository, Documentation, Bug Tracker). Classifiers already covered Python 3.11–3.13 and Security/AI topics — left as-is.
• publish.yml: Fixed several issues in the existing file — pinned actions to real stable versions (v4/v5 from non-existent v6/v7/v8), switched build from `python -m hatchling build` to `python -m build` (standard PEP 517), tightened tag pattern from `v*` to `v*..`, added `permissions: id-token: write` to the `publish` job (was missing, OIDC would have failed at runtime).
• release-drafter.yml: New workflow to auto-draft a GitHub Release with generated notes on tag push.

cmcp-verify packaging note

`cmcp-verify` is co-packaged in `src/cmcp_verify/` with no separate `pyproject.toml`. The wheel includes both packages via `[tool.hatch.build.targets.wheel] packages = ["src/cmcp_gateway", "src/cmcp_verify"]` — no change needed.

After merging

1. Create a `pypi` environment in GitHub repo Settings > Environments
2. Register the trusted publisher at pypi.org with publisher `agentrust-io/cmcp`, workflow `publish.yml`, environment `pypi`
3. Tag a release: `git tag v0.1.0 && git push origin v0.1.0`

🤖 Generated with Claude Code