Enable CI and PyPI release workflows

.github/workflows/ci.yml

@@ -0,0 +1,36 @@
+# Template — copy to `.github/workflows/ci.yml` to enable.
+#
+# Pure-Python pytest matrix for the dcebe package. The agent does not
+# touch .github/ directly per CLAUDE.md; copy this file into place
+# manually and commit on a separate branch (no agent push).
+
+name: CI
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+
+      - name: Install package and test deps
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .[test]
+
+      - name: Run pytest (skip MATLAB parity if fixtures absent)
+        run: pytest tests_py/ -v

.github/workflows/release.yml

@@ -0,0 +1,58 @@
+# Template — copy to `.github/workflows/release.yml` to enable.
+#
+# Tag-gated PyPI publication via OIDC trusted publishing. No PyPI API
+# token required after one-time configuration on PyPI side. Triggers
+# only on annotated tags matching `v*.*.*`.
+
+name: Release
+
+on:
+  push:
+    tags: ["v*.*.*"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build backend
+        run: |
+          python -m pip install --upgrade pip
+          pip install build
+
+      - name: Build sdist and wheel
+        run: python -m build
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/dcebe
+    permissions:
+      id-token: write     # required for OIDC trusted publishing
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        # No `password:` argument — OIDC trusted publisher (configure
+        # at https://pypi.org/manage/account/publishing/ before the
+        # first release).