ci: SDK release workflows for PyPI + npm (#36, #38)

[mkorbi]

Adds tag-triggered publish automation for both client SDKs — a release becomes a version bump + a tag instead of a manual build/upload. Addresses the npm-publish half of #36 and the PyPI-publish bullet of #38.

What's automated

• Python → PyPI (release-python-sdk.yml): builds sdist+wheel, runs twine check, publishes via PyPI Trusted Publishing (OIDC — no stored token). Fires on a python-sdk-v* tag; workflow_dispatch can target TestPyPI for a rehearsal. pyproject.toml gains [project.urls], classifiers, keywords.
• TypeScript → npm (release-typescript-sdk.yml): builds, tests, packs, publishes with provenance (id-token: write) using an NPM_TOKEN secret. Fires on a typescript-sdk-v* tag; workflow_dispatch defaults to a build/pack-only dry run. package.json gains repository/homepage/bugs/keywords, publishConfig (access public + provenance), sideEffects: false, and a prepublishOnly build.
• RELEASING.md documents the one-time registry setup and the tag-to-release flow.

⚠️ Requires one-time registry setup (yours to do)

Publishing can't fully self-configure. Before the first release, per RELEASING.md:

• PyPI: add a pending Trusted Publisher for project memsidecar, repo vibed-project/MemorySidecar, workflow release-python-sdk.yml, env pypi (and testpypi to rehearse).
• npm: ensure the @memsidecar scope exists and add an automation token as the NPM_TOKEN repo secret.

I did not publish anything — that's outward-facing and needs those credentials.

Verification

Local: python -m build produces a wheel containing the client, gen stubs, and both ext adapters; npm pack includes the built dist + declarations; npm ci/build/test pass. Both workflow files pass actionlint. The workflows only trigger on their tags / manual dispatch, so they don't run on this PR.

Note: tag from main after #54 merges so the published SDKs include the regenerated stubs + wrappers. The remaining #38 items (docker-compose, examples/, memctl data-plane verbs) are follow-ups.