Add a PyPI release pipeline (Trusted Publishing) for the extension

`titiler-covjson` is meant to ship as an installable TiTiler extension, but only a test-on-PR CI workflow exists (#5) -- there is no release/publish pipeline. Add one (found by the roadmap-realignment audit; part of the original Story 11/13).

## Scope

- A tag-triggered GitHub Actions release workflow that publishes to PyPI via OIDC **Trusted Publishing** (no long-lived token).
- The usual safeguards: actions pinned to commit SHAs, least-privilege `permissions`, injection-safe steps.
- A documented release process: version bump, changelog/notes, tag, publish.

The `github-workflows` skill scaffolds this (CI + release with PyPI Trusted Publishing + security scanning).

## Status

Infrastructure, not a domain slice. No milestone (or a new infra milestone if you prefer). Schedule when a first public release is wanted.

Start by inspecting the existing test-on-PR GitHub Actions workflow and the extension's packaging and version metadata. Define the tag-triggered release flow, Trusted Publishing permissions, SHA-pinned actions, and documented version, changelog, tag, and publish steps. Done means a tagged release can publish to PyPI without a long-lived token and the release process is documented.

Written by the indexing model from the issue text.