docs(ci): clarify why pypi-publish.yml and release.yml both build on tags

.github/workflows/ci.yml

@@ -47,7 +47,7 @@ jobs:
           cache: "pip"
 
       - name: Install Ruff
-        run: pip install ruff
+        run: pip install ruff==0.12.3
 
       - name: Ruff check
         run: ruff check .

.github/workflows/pypi-publish.yml

@@ -1,3 +1,7 @@
+# Publishes the package to PyPI. Runs alongside release.yml (same v* tag
+# trigger, separate purpose): this workflow publishes the distribution to
+# PyPI via trusted publishing; release.yml creates the GitHub Release with
+# generated notes and uploads the same distribution as release assets.
 name: Publish to PyPI
 
 on:

.github/workflows/release.yml

@@ -1,3 +1,8 @@
+# Creates the GitHub Release with generated notes and uploaded distribution
+# assets. Runs alongside pypi-publish.yml (same v* tag trigger, separate
+# purpose): that workflow publishes the distribution to PyPI; this one
+# publishes the GitHub Release. Each builds its own copy of the package
+# rather than sharing a build artifact between the two workflows.
 name: Release
 
 on:

pyproject.toml

@@ -38,7 +38,7 @@ dependencies = [
 [project.optional-dependencies]
 dev = [
     "pytest>=8.0.0",
-    "ruff>=0.8.0",
+    "ruff==0.12.3",
 ]
 
 [project.scripts]