fix: pin hatchling==1.27.0 + bump pypi-publish to v1.14.2 (Metadata-Version 2.5)

The v0.3.0 PyPI publish failed in gh-action-pypi-publish's
verify_metadata step: unpinned hatchling floated to 1.32.x, which emits
Metadata-Version 2.5, unsupported by the pinned ed0c539 action image
(twine < 7). Mirrors qwed-verification #318:

- Pin hatchling==1.27.0 (emits Metadata-Version 2.4, broadly supported)
  so builds are reproducible and metadata stops floating.
- Bump pypa/gh-action-pypi-publish to v1.14.2 (twine >= 7, supports
  metadata 2.5) as defense-in-depth for future backend bumps.
- skip-existing: true so retry attempts after partial uploads do not
  fail on PyPI's immutable artifact rule.

Verified locally: wheel builds with Metadata-Version 2.4.

513 tests pass.

Author: rahuldass19

.github/workflows/publish.yml

@@ -26,4 +26,8 @@ jobs:
     - name: Build package
       run: python -m build
     - name: Publish package distributions to PyPI
-      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
+      # v1.14.2 (twine >= 7): the older release/v1 pin ships twine < 7,
+      # which rejects Metadata-Version 2.5 emitted by floating hatchling.
+      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+      with:
+        skip-existing: true

pyproject.toml

@@ -33,7 +33,7 @@ Issues = "https://github.com/QWED-AI/qwed-infra/issues"
 Changelog = "https://github.com/QWED-AI/qwed-infra/blob/main/CHANGELOG.md"
 
 [build-system]
-requires = ["hatchling"]
+requires = ["hatchling==1.27.0"]
 build-backend = "hatchling.build"
 
 [tool.hatch.build.targets.wheel]