Guard release deployment and tag successful uploads

[iskandr]

deploy.sh could publish from any checkout, ignored a requested version, and never tagged the release. It now deploys only the merged version from a clean main/master matching the live branch on origin, with no existing release tag. One sequence runs lint, tests, build and strict distribution checks, rechecks release state, uploads the exact wheel/sdist pair, then tags the original commit and pushes only the tag.

--dry-run follows that sequence through distribution checks and stops before publication. An optional version asserts the version already merged in the PR; it never creates a direct-main version bump. Each attempt preserves its original artifacts for verification and recovery. AGENTS.md, contributor setup and release instructions describe the same workflow. Version: 10.11.3.

Validation:

• 38 deployment regressions use real temporary repositories and a local bare origin, with offline build/upload stubs. They cover clean/dirty/detached branches, stale remote-tracking refs, version mismatches, existing tags, build-time state changes, every failed stage, dry-run immutability, and successful tag publication.
• ./lint.sh, ./test.sh (3,193 passed) and mkdocs build --strict all pass. The 13 argument/checkout/dry-run regressions fail against the previous script.
• Real wheel and source distribution build; both pass twine check --strict.

Closes #414. Historical tag/changelog reconstruction remains tracked in #411. The sibling-script inspection also uncovered and reproduced a dry-run mutation bug, filed as openvax/vaxrank#560.

Published 10.11.3 from merged commit 6f29cf8c5201189ae2803ad319aacca8053f7ddf using the new script. Deployment reran all 3,193 tests, then uploaded both distributions and pushed v10.11.3 to that same commit. The installed PyPI package passed an isolated import and CFTR baseline/cis annotation smoke test; both published SHA256 hashes match the preserved original files:

• Wheel: 552724b74e9a17423237289b4033c3b3ca919514d36f6fa955b64223ae42b9a9
• Source distribution: 9451d9d81c972c8116743a69bff8352a5c0398aefb486eaad106c2c916bdc65e

Post-merge verification: Python matrix, documentation deployment.