ci: allow TestPyPI candidate builds from testpypi/* branches

[cursor]

Summary

Adds a push trigger on testpypi/** branches to publish-testpypi.yml so the release automation can run TestPyPI validation for a release candidate by pushing the candidate head to a testpypi/<version> branch. The automation's GitHub App token cannot call workflow_dispatch (actions: write is not granted; dispatch returns 403), but it can push branches. Manual dispatch is unchanged. The release PR template checklist wording is updated to match.

Push-triggered runs use the existing default .dev<run_number><run_attempt> suffix, so each candidate build gets a unique TestPyPI version. Job permissions, the testpypi environment, the trusted publisher binding (repository + workflow filename + environment), and the openenv-package-publish concurrency group are all unchanged.

This is a release-workflow policy change, so it needs maintainer review. Anyone who can push a testpypi/* branch can trigger a TestPyPI (not production) upload; that is the same population that can already dispatch the workflow manually.

Type of Change

• Bug fix
• New feature (CI/release tooling)
• Breaking change
• Documentation (release PR template wording)
• New environment
• Refactoring

Alignment Checklist

• I have read .claude/docs/PRINCIPLES.md and this PR aligns with our principles
• I have checked .claude/docs/INVARIANTS.md and no invariants are violated (no credential exposure; no runtime code)
• Workflow YAML parses; no Python or test changes, so lint/tests are unaffected

RFC Status

• Not required (CI/release tooling change)
• RFC exists: #___
• RFC needed (will create before merge)

Test Plan

• Live validation: testpypi/0.4.2 was pushed at 1b0ce3834506bc7aa869f77867aacb107ee9887b (exact 0.4.2 candidate head 81c0207cd5aa30eea620ae5287391f4809c8236a plus only this commit; src/, pyproject.toml, README.md, and LICENSE are byte-identical to the candidate). It triggered https://github.com/huggingface/OpenEnv/actions/runs/34329574183 via the push event.
• Reviewers can confirm that run builds, publishes 0.4.2.devN to TestPyPI, and verifies the exact install.

Claude Code Review

N/A — 10-line workflow trigger addition plus template wording; reviewed by the release automation.