ci(ingestion): publish to PyPI before creating the release tag - #602

Critical — .github/workflows/release-ingestion.yml, added “Download build artifacts” step before actions/checkout: actions/checkout cleans/prepares the workspace and will remove the untracked dist/ directory downloaded immediately before it. The subsequent PyPI action therefore has no packages to publish, causing every release to fail. Move checkout before artifact download, or download artifacts under ${{ runner.temp }} and publish from there.

Critical — same hunk, publishing before GitHub release creation: If PyPI publication succeeds but checkout or gh release create fails, rerunning the workflow attempts to upload the immutable version again. PyPI rejects duplicate distributions, so the retry never reaches release creation, leaving the release permanently incomplete. Make publication retry-safe (for example, skip-existing: true with appropriate validation) or redesign the ordering/rollback behavior so a rerun can finish the GitHub release.