ci: automate releases on merge to main

[owlas]

What

Replaces the manual `just publish` flow with GitHub Actions so releases happen automatically on merge to main. Jake (and anyone else) no longer needs to know the release dance.

Workflows

• `ci.yml` — runs the unit test suite on every PR and push to main (Python 3.9 + 3.12). Excludes `test_acceptance.py` and `test_query.py`, which require a live Lightdash instance + credentials.
• `release.yml` — on merge to main: runs tests, then python-semantic-release computes the next version from Conventional Commit messages (`feat:` → minor, `fix:` → patch, `BREAKING CHANGE` → major), bumps `pyproject.toml`, tags, creates a GitHub Release, and publishes to PyPI via Trusted Publishing (OIDC — no stored tokens).

Other

• Added an explicit `[build-system]` table (setuptools) — it was missing entirely.
• Added `[tool.semantic_release]` config; versions are anchored by a baseline `v1.0.1` tag (pushed) matching the current PyPI release.

Why now

main currently declares `version = "1.0.1"` but PyPI already has 1.0.1 — and there are 8 unreleased PRs sitting behind that already-used version number (row-cap fix, SQL compile, Bearer auth, etc.). Manual releases had drifted. Automation fixes this.

⚠️ Required before merge

PyPI Trusted Publishing must be configured once, or the publish step will fail:

• pypi.org → project `lightdash` → Settings → Publishing → Add a GitHub publisher
• Owner `lightdash`, repo `python-sdk`, workflow `release.yml`, environment blank

What happens on merge

semantic-release will compute 1.1.0 (the 8 unreleased PRs include `feat:` commits) and publish it to PyPI automatically.