fix: pin pypi-publish to SHA; add migration 0015 for slug unique_with

- Pin pypa/gh-action-pypi-publish to full commit SHA (cef2210) instead
  of mutable release/v1 tag; keep tag as trailing comment
- Add migration 0015 to capture unique_with=("region","subregion") on
  AbstractCity.slug added in the maintenance pass — state-only change,
  no SQL DDL emitted by autoslug

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 2 people

.github/workflows/python-publish.yml

@@ -28,6 +28,6 @@ jobs:
     - name: Build package
       run: python -m build
     - name: Publish package
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # release/v1
       with:
         password: ${{ secrets.PYPI_API_TOKEN }}

src/cities_light/migrations/0015_city_slug_unique_with_region_subregion.py

@@ -0,0 +1,25 @@
+# Capture unique_with=("region", "subregion") added to AbstractCity.slug.
+# This is an application-level change only (autoslug enforces uniqueness in
+# Python); no SQL DDL is emitted, but the migration state must match the model.
+
+import autoslug.fields
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("cities_light", "0014_fix_search_names_index"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="city",
+            name="slug",
+            field=autoslug.fields.AutoSlugField(
+                editable=False,
+                populate_from="name_ascii",
+                unique_with=("region", "subregion"),
+                verbose_name="slug",
+            ),
+        ),
+    ]