ci: add publish job to release-please and use GitHub-generated notes (#12)

## Summary
- Moves CI and publish jobs into the release-please workflow,
conditioned on `release_created == true`
- Fixes the GITHUB_TOKEN limitation where releases created by
`github-actions[bot]` don't trigger `publish.yml`
- After Release Please creates a release, regenerates the notes using
GitHub's native auto-generated format (`.github/release.yml` categories)
instead of Release Please's commit-list style

## How it works
1. Release Please runs on every push to main — opens/updates a release
PR
2. When the release PR is merged, Release Please creates the tag +
release
3. Same workflow then: regenerates notes → runs CI → publishes to PyPI

## Test plan
- [ ] Merge this PR — Release Please should open a release PR (for `ci:`
commits, it won't — that's correct)
- [ ] On next `fix:` or `feat:` merge, verify the full chain: release PR
→ merge → tag + release with GitHub-style notes → CI → PyPI publish

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: weklund

.github/workflows/release-please.yml

@@ -11,9 +11,90 @@ permissions:
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
       - uses: googleapis/release-please-action@v4
+        id: release
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
+
+      - name: Regenerate release notes
+        if: ${{ steps.release.outputs.release_created == 'true' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api repos/${{ github.repository }}/releases/generate-notes \
+            -f tag_name=${{ steps.release.outputs.tag_name }} \
+            --jq '.body' \
+          | gh release edit ${{ steps.release.outputs.tag_name }} \
+              --repo ${{ github.repository }} \
+              --notes-file -
+
+  ci:
+    name: CI
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: macos-latest
+    strategy:
+      matrix:
+        python-version: ["3.13"]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - name: Install Python ${{ matrix.python-version }}
+        run: uv python install ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: uv sync --dev
+
+      - name: Lint
+        run: uv run ruff check src/ tests/
+
+      - name: Typecheck
+        run: uv run python -m pyright
+
+      - name: Test
+        run: uv run pytest --cov=src/mlx_stack -x -q --tb=short
+
+  publish:
+    name: Build & Publish
+    needs: [release-please, ci]
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: ubuntu-latest
+
+    permissions:
+      id-token: write
+
+    environment:
+      name: pypi
+      url: https://pypi.org/p/mlx-stack
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.release-please.outputs.tag_name }}
+          fetch-depth: 0
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - name: Build package
+        run: uv build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1