fix(release): suppress NU5104 + portable Python version verify

Two failures from v0.1.0 release run:

1. C# pack failed NU5104 — stable 0.1.0 with FlashAlpha.Historical 0.4.0-rc.10
   pre-release dependency. The pin is intentional (rc.10 is the first publish
   carrying the GexResponse/StrikeRow types); Python side already accepts
   >=0.4.0rc1. Added NoWarn=NU5104 with a comment explaining the choice.

2. release-python.yml version verify used grep -oPm1 with a lookbehind that
   not all runner greps support. Swapped to python -c "tomllib.load(...)" —
   tomllib is stdlib on the runner's Python 3.12, no flag-portability risk.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: tdobrowolski1

.github/workflows/release-python.yml

@@ -17,13 +17,10 @@ jobs:
 
       - name: Verify tag matches pyproject version
         run: |
-          TAG_VERSION=${GITHUB_REF_NAME#v}
-          # Strip any pre-release dot from PEP 440 (e.g. 0.2.0rc1 → 0.2.0rc1; tag would be 0.2.0-rc.1)
-          # Tags use SemVer (v0.2.0-rc.1) and PyPI uses PEP 440 (0.2.0rc1) — normalize for comparison.
-          TAG_NORMALIZED=$(echo "$TAG_VERSION" | tr -d '-' | tr -d '.' | sed 's/rc/.rc./' || true)
-          PYPROJ_VERSION=$(grep -oPm1 '(?<=^version = ")[^"]+' src/python/pyproject.toml)
-          # Simple equality after stripping
-          A=$(echo "$TAG_VERSION" | tr -d 'v-.')
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          PYPROJ_VERSION=$(python -c "import tomllib; print(tomllib.load(open('src/python/pyproject.toml','rb'))['project']['version'])")
+          # Normalize SemVer pre-release (0.2.0-rc.1) ↔ PEP 440 (0.2.0rc1) for comparison
+          A=$(echo "$TAG_VERSION" | tr -d '-.')
           B=$(echo "$PYPROJ_VERSION" | tr -d '-.')
           if [ "$A" != "$B" ]; then
             echo "Tag $TAG_VERSION does not match pyproject version $PYPROJ_VERSION"

src/csharp/FlashAlpha.QuantConnect/FlashAlpha.QuantConnect.csproj

@@ -13,6 +13,14 @@
     <RepositoryUrl>https://github.com/FlashAlpha-lab/flashalpha-quantconnect</RepositoryUrl>
     <RepositoryType>git</RepositoryType>
     <PackageReadmeFile>README.md</PackageReadmeFile>
+    <!--
+      Intentionally pinned to FlashAlpha.Historical 0.4.0-rc.10 — that is the
+      first published version carrying the GexResponse / GexStrikeRow / etc.
+      types this bridge wraps. The Python side accepts >=0.4.0rc1 in the
+      stable release per PEP 440. Suppress NU5104 so a stable 0.1.0 with a
+      pre-release dep is allowed; the dep version is documented + intentional.
+    -->
+    <NoWarn>$(NoWarn);NU5104</NoWarn>
   </PropertyGroup>
 
   <ItemGroup>