Fix release tag publishing and update Python support

[anth-volk]

Fixes #250
Fixes #535

Compatibility notice

Breaking change: this PR intentionally ends support for Python 3.9 and 3.10. Future PolicyEngine Core releases will require Python 3.11 or newer. Existing compatible Core releases remain available from PyPI, but users on Python 3.9/3.10 must remain on an older release or upgrade Python before taking a newer Core release.

Python 3.9/3.10 support was restored temporarily in #454 for the Census compatibility effort. PolicyEngine US and PolicyEngine UK have since raised their minimum supported version to Python 3.11, so preserving older-version compatibility in new Core releases no longer provides a consistently supported country-model stack. Issue #535 tracks this removal explicitly.

What's changed

• Read the release version from pyproject.toml instead of the removed setup.py.
• Publish the Git tag only after PyPI publication succeeds.
• Give the publishing job explicit repository write permission and fetch existing tags.
• Propagate tag-push failures and make repeated runs safe when the tag already exists.
• Require Python 3.11 or newer, remove the Python 3.9/3.10 CI jobs and dependency rules, and regenerate uv.lock for the supported range.
• Stop exercising the Ubuntu-only Bash release script on Windows, where bash.exe is the unavailable WSL launcher; the workflow-structure test still runs on Windows.

Validation

• uv lock --check
• uv run --locked --extra dev ruff format .
• uv run --locked --extra dev ruff check .
• uv run --python 3.11 --locked --extra dev pytest tests/core/test_release_tagging.py tests/core/tools/test_google_cloud.py tests/core/tools/test_hugging_face.py -v — 29 passed
• uv run --python 3.11 --locked --extra dev make test — 695 passed, 4 skipped, 1 expected failure
• uv build — wheel metadata contains Requires-Python: >=3.11 and only Python 3.11–3.14 classifiers
• uv run --python 3.11 --locked --extra dev make documentation — succeeded with 32 existing warnings
• bash -n .github/publish-git-tag.sh
• git diff --check

make format was replaced with its equivalent Ruff commands because Ruff is installed in the project environment rather than directly on the shell path.

Documentation review

The README support range now matches package metadata and CI. No API-reference changes are required. Impact is medium because Python 3.9/3.10 installations will remain on older Core releases; confidence is high based on minimum-version tests and built-wheel metadata. policyengine.py still has separate stale Python-version metadata that should be handled in that repository.