fix CI: add notebook change detection, expand release matrix, clean up dead code

- main.yml: add detect-notebooks-change job; gate notebooks on it to skip
  expensive runs on unrelated PRs (always fires on push to main)
- main.yml: remove dead if: false codecov upload step
- release.yml: drop Linux-only container from test job; add macOS and
  Windows to release test matrix (5 → 15 jobs)
- release.yml: rename PY_VERSION → PKG_VERSION to avoid confusion with
  the Python interpreter version

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: tschm

.github/workflows/main.yml

@@ -225,19 +225,50 @@ jobs:
             --cov=./ \
             --cov-report=xml
 
-      # Upload currently disabled
-      - name: Upload coverage to Codecov
-        if: false
-        uses: codecov/codecov-action@v5
+
+  # ================================================================
+  # 5️⃣ NOTEBOOK CHANGE DETECTION
+  #
+  # Checks whether any notebook-relevant paths changed.
+  # Skips expensive notebook execution on unrelated PRs.
+  #
+  # On push to main, always runs notebooks (something was merged).
+  # On PRs, diffs against origin/main to detect changes in:
+  #   - cookbook/     (notebooks themselves)
+  #   - pypfopt/      (library code notebooks depend on)
+  #   - pyproject.toml (dependency changes)
+  # ================================================================
+  detect-notebooks-change:
+    needs: code-quality
+    runs-on: ubuntu-latest
+    outputs:
+      notebooks: ${{ steps.check.outputs.notebooks }}
+
+    steps:
+      - uses: actions/checkout@v4
         with:
-          files: ./coverage.xml
-          fail_ci_if_error: true
+          fetch-depth: 0
+
+      - name: Fetch main branch
+        run: git fetch origin main
+
+      - name: Check if notebook-related files changed
+        id: check
+        run: |
+          if [ "${{ github.event_name }}" = "push" ]; then
+            echo "notebooks=true" >> $GITHUB_OUTPUT
+          elif git diff --quiet origin/main -- cookbook/ pypfopt/ pyproject.toml; then
+            echo "notebooks=false" >> $GITHUB_OUTPUT
+          else
+            echo "notebooks=true" >> $GITHUB_OUTPUT
+          fi
 
 
   # ================================================================
-  # 5️⃣ NOTEBOOK TESTING
+  # 6️⃣ NOTEBOOK TESTING
   #
   # Executes Jupyter notebooks via nbmake.
+  # Only runs when notebook-relevant files changed (see above).
   #
   # For each Python version:
   #   - Install interpreter via uv
@@ -250,7 +281,8 @@ jobs:
   #   - No silent drift between code and notebooks
   # ================================================================
   notebooks:
-    needs: code-quality
+    needs: detect-notebooks-change
+    if: ${{ needs.detect-notebooks-change.outputs.notebooks == 'true' }}
     runs-on: ubuntu-latest
 
     strategy:

.github/workflows/release.yml

@@ -58,16 +58,16 @@ jobs:
 
           # Read version from pyproject.toml using Python
           # We rely on tomllib (Python 3.11+) for robust parsing.
-          PY_VERSION=$(python - <<'PY'
+          PKG_VERSION=$(python - <<'PY'
           import pathlib, tomllib
           data = tomllib.loads(pathlib.Path("pyproject.toml").read_text())
           print(data["project"]["version"])
           PY
           )
 
           # Fail fast if mismatch
-          if [ "$GH_TAG_NAME" != "$PY_VERSION" ]; then
-            echo "::error::Tag ($GH_TAG_NAME) does not match pyproject version ($PY_VERSION)"
+          if [ "$GH_TAG_NAME" != "$PKG_VERSION" ]; then
+            echo "::error::Tag ($GH_TAG_NAME) does not match pyproject version ($PKG_VERSION)"
             exit 1
           fi
 
@@ -137,10 +137,7 @@ jobs:
   # ================================================================
   test:
     needs: build
-    runs-on: ubuntu-latest
-
-    container:
-      image: ghcr.io/astral-sh/uv:0.9.30-bookworm
+    runs-on: ${{ matrix.os }}
 
     strategy:
       fail-fast: false
@@ -150,25 +147,31 @@ jobs:
         #   - pyproject.toml requires-python
         #   - your long-term support policy
         python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+        os: [ubuntu-latest, macos-latest, windows-latest]
 
     steps:
       - uses: actions/checkout@v4
 
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
       - uses: actions/download-artifact@v4
         with:
           name: dist
           path: wheelhouse
 
       - name: Install and pin Python ${{ matrix.python-version }}
+        shell: bash
         run: |
-          # Read version from pyproject.toml
-          PY_VERSION=$(python - <<'PY'
+          # Read package version from pyproject.toml
+          PKG_VERSION=$(python - <<'PY'
           import pathlib, tomllib
           data = tomllib.loads(pathlib.Path("pyproject.toml").read_text())
           print(data["project"]["version"])
           PY
           )
-          echo "PY_VERSION=${PY_VERSION}" >> $GITHUB_ENV
+          echo "PKG_VERSION=${PKG_VERSION}" >> $GITHUB_ENV
 
           # Install requested interpreter version
           uv python install ${{ matrix.python-version }}
@@ -181,10 +184,12 @@ jobs:
           uv run python --version
 
       - name: Install built wheel with dev dependencies
+        shell: bash
         run: |
           # Install the wheel artifact (NOT source install)
           # [dev,all_extras] assumes these are declared as optional dependencies.
-          uv pip install "wheelhouse/pyportfolioopt-${PY_VERSION}-py3-none-any.whl[dev,all_extras]"
+          uv venv --clear
+          uv pip install "wheelhouse/pyportfolioopt-${PKG_VERSION}-py3-none-any.whl[dev,all_extras]"
 
       - name: Verify dependency graph integrity
         run: |