ci(release): publish to PyPI only after main's CI passes on the tagged commit

[AlexS-scale]

What and why

publish-pypi.yml uploads to PyPI when the release automation pushes a v* tag. It pushes that tag about 20 seconds after the version bump. Thus the upload ends before main's CI has run on the commit, and nothing checks the result. For example, v0.9.1258 was on PyPI at 22:20 UTC on 2026-09-30. Local backends failed on the same commit at 22:28 (run). It occurred again with v0.9.1325: it was on PyPI at 15:15 UTC on 2026-10-14, and Local backends failed on the same commit at 15:33 (run).

This change adds a main-ci job before the upload jobs. The job waits for the push runs of local-backends.yml, clean-install.yml and plugin-api.yml on main for the tagged commit. If one of them does not pass, the job fails and blocks publishing.

• A release now comes about 20 minutes after the bump, not about 1 minute after it.
• If a run fails and then passes on a re-run, re-run this workflow to publish.
• The job stops after 60 minutes. Thus it blocks publishing for a tag on a commit that never ran on main.

How it was tested

The job's script ran locally against the real runs, with bash -eo pipefail as in Actions:

• 552c08c (v0.9.1324, all runs passed): exit 0.
• a6699d5 (v0.9.1258, Local backends failed): exit 1, with a link to the failed run.
• A commit with no runs on main: the script continued to wait.

actionlint with shellcheck reports no findings.