PyPI release pipeline + official ovvo-nns package name

[OVVO-Financial]

Builds the publish path for the native (C++17 / nanobind) package and sets
the official distribution name to ovvo-nns.

Official name: ovvo-nns

Publish under the new, unencumbered PyPI name rather than taking over the legacy
NNS project. Distribution name only — the import package stays nns:

pip install ovvo-nns
import nns

So there's zero code/test/vignette churn (same pattern as scikit-learn →
import sklearn). Changed in pyproject.toml, README.md, and docs/releasing.md
(claim ovvo-nns via a pending Trusted Publisher — no NNS takeover needed;
legacy NNS noted as an optional later alias).

Release pipeline

• pyproject.toml → [tool.cibuildwheel] — CPython 3.11–3.13 wheels for
  Linux (manylinux + musllinux x86_64), macOS (x86_64 + arm64), Windows
  (AMD64); each wheel smoke-tested by importing the native extension. PyPy /
  32-bit skipped; scikit-build-core fetches CMake/Ninja.
• .github/workflows/release.yml — build all wheels + sdist, publish via
  PyPI Trusted Publishing (OIDC) (no stored token, PEP 740 attestations).
  Tag v* → PyPI; workflow_dispatch → none | testpypi | pypi. Uses GitHub
  environments pypi / testpypi.
• scripts/check_release_provenance.py + test — gate: tag matches pyproject
  version and sync/nns_source.json records non-placeholder r_commit /
  core_commit. --allow-unknown for dry runs.
• docs/releasing.md — one-time Trusted Publisher / environment setup + flow.

Safety & validation

Build/CI only; no runtime behavior changes. Nothing publishes until the
Trusted Publisher + environments are configured and a tag is cut. Verified:
pip install -e . resolves dist ovvo-nns and import nns works; ruff clean;
release.yml + pyproject parse; provenance gate behaves; 11/11 tools tests pass.

https://claude.ai/code/session_017KnASettwNxUdYJzchRLux