[Piergiuseppe]

What changes

• The test, free-threaded and build jobs run on every pull request, and on every push to main that touches more than the docs. Public repositories run on GitHub-hosted runners for free, so this costs no Actions minutes.
• A final ci-passed job reports one check that fails unless the build succeeded, and the build only runs once every test job has passed. That single check is the one main requires before a merge, so adding a Python version to the matrix needs no change to the ruleset. A skipped job counts as passed for a required check, so ci-passed always runs and tests the build result itself.
• PyPI publishing still happens only from a v* tag, and the tag is checked against tinyjobs.__version__ only there.
• After PyPI, a new job creates the GitHub release for the tag, with notes generated from the merged pull requests.
• A newer run on a branch or pull request cancels the one it supersedes; a tag run is never cancelled.

Notes

• Pull requests run whatever they touch: a required check that never reports would block a docs-only pull request forever.
• PyPI trusted publishing is bound to the workflow file and the tinyjobs environment, both unchanged: only the display name moves from release to ci.
• Settle the public surface before freezing it: changelog, compatibility page, upgrade check #13 adds the same if: to publish, so the two pull requests merge cleanly in either order. Once Settle the public surface before freezing it: changelog, compatibility page, upgrade check #13 is in, build also waits for upgrade, and ci-passed covers it with no change.
• Path filters are not evaluated on tag pushes, so a release always runs the full pipeline.