Port mailsuite's tag-triggered release pipeline:
- Add release.yml: pushing a version tag runs the full CI suite
(python-tests.yml via workflow_call), then builds the package (the tag
must match the version in parsedmarc/constants.py, checked with
`hatch version`), publishes to PyPI via Trusted Publishing, creates
the GitHub Release with notes from the tag's CHANGELOG.md section and
the built distributions attached, pushes the multi-arch Docker image,
and deploys the Sphinx docs
- Add docs.yml: reusable docs build/deploy to GitHub Pages, also
runnable on demand (workflow_dispatch) for documentation-only changes
between releases
- docker.yml: add a workflow_call trigger with a push_image input, since
a GitHub Release created with the workflow's own GITHUB_TOKEN emits no
`release: published` event; release.yml calls it directly instead
- Remove the legacy build.sh / publish-docs.sh manual process
- AGENTS.md: CRITICAL rule that releases require explicit maintainer
permission, plus docs for the new release flow and its one-time
repo/PyPI configuration prerequisites
- Bump the mailsuite floor to >=2.3.0 (raises the transitive mail-parser
floor to >=4.6.2 and cryptography to >=50.0.0)
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
