fix: repair 1.0.0 publishing

[poly-william]

Why

The market response type release was intended to publish 1.0.0, but the publish run failed during checkout because its configured personal token could not authenticate. The existing workflow would then have tried to push its generated version commit directly to protected main, which the repository rules require to go through a reviewed PR.

main still declares 0.1.2, and PyPI has no 1.0.0 release.

What changes

• Set the reviewed package version to 1.0.0 in pyproject.toml.
• Use the repository-native checkout credential with read-only contents access.
• Remove the workflow's direct commit and push to main.
• Build both distributions before checking PyPI's release-file metadata.
• Skip only when both built filenames already exist; for a partial release, upload only the missing artifact.
• Before completing a partial release, require every existing matching artifact's PyPI SHA-256 to match the local build.

After this PR merges, the workflow will test and build 1.0.0, see that both artifacts are absent from PyPI, and publish them with the existing PyPI credential. Later non-release merges with a complete release will rebuild for comparison, then exit without uploading it again.

If a partial release's existing wheel or sdist does not match the rebuild byte-for-byte, the workflow stops. This can require manual recovery when builds are not reproducible, but it prevents combining artifacts produced by different source states or toolchains.

Verification

• pytest — 148 tests
• mypy — package, type contracts, release helper, and release-helper tests; 35 files
• ruff check .
• ruff format --check .
• uv build
• actionlint .github/workflows/publish.yml
• Verified wheel metadata reports polymarket-us version 1.0.0
• Exercised complete, absent, HTTP-error, and malformed-metadata responses against the workflow shell
• Verified matching wheel-only and sdist-only partials stage only the missing artifact
• Verified mismatched wheel-only and sdist-only partials, plus missing or malformed SHA-256 metadata, fail without staging files

---

Note

Medium Risk
Changes release automation and PyPI upload behavior (idempotent/partial uploads); incorrect guard logic could skip needed uploads or publish wrong artifacts, though SHA256 checks mitigate partial-release risk.

Overview
Bumps the package version to 1.0.0 in pyproject.toml so a reviewed release can ship after a failed publish attempt left PyPI without that version.

The publish workflow no longer auto-bumps pyproject.toml, commits, or pushes to main (and drops the PAT / write permissions). It reads name and version from pyproject.toml, builds, then queries PyPI and runs a new check_pypi_artifacts.py helper. Publishing runs only when the script returns true, uploading from publish-dist instead of the full dist folder.

The new script compares built wheel/sdist filenames to PyPI release JSON: skip when both exist; for partial releases, verify SHA256 of already-listed files and stage only missing artifacts; fail on digest mismatch or bad metadata. Offline pytest coverage exercises absent, complete, partial, and failure paths.

^{Reviewed by Cursor Bugbot for commit 76633dd. Bugbot is set up for automated code reviews on this repo. Configure here.}