th#1918: .yml -> .yaml in python-gen-worker (PyPI trusted-publisher filename must be updated)

[PaulFidika]

Paul, 2026-08-13: "please rename all .yml -> .yaml; I'm going with that naming now instead."
Fleet-wide campaign, tracked as th#1918; one mechanical PR per repo.

⚠️ ACTION REQUIRED ON PyPI BEFORE THE NEXT gen-worker TAG

PyPI trusted publishing binds to the workflow FILENAME. The trusted-publisher entry for
the gen-worker project names publish.yml. Once this merges, a tag push mints an OIDC
token whose workflow_ref says publish.yaml, and PyPI will refuse the upload — the
publish job goes red at the last step, after CI, build and provenance have all passed.

Fix (Paul, one edit, ~30 seconds): PyPI → gen-worker → Manage → Publishing → edit the
GitHub publisher's Workflow name from publish.yml to publish.yaml. Do it before the
next release cut; nothing else in the release procedure changes.

This is the only OIDC-bound workflow in the cozy repos other than cozy-eval, whose
publish.yml → publish.yaml rename is already merged — so the cozy-eval trusted-publisher
entry needs the same edit and is broken right now until it gets one.

What changed

Renames: ci, native-kernels, proto-contract, publish workflows and Taskfile.
No name: or job id changes, so fast gates / tests and the merge queue are untouched.

Load-bearing references updated in the same commit:

• native-kernels and proto-contract self-referencing paths: filters — a stale entry
  there would stop each workflow triggering on edits to itself.
• scripts/assert_ci_proof.py: the Actions API path actions/workflows/ci.yaml/runs.
  Note GitHub treats a renamed workflow as a new one, so this query returns only runs from
  after the rename — the first post-merge ci run repopulates it, which happens on this
  merge itself.
• scripts/lint_mypy_ratchet.py workflow path.
• tests/test_publish_proof_gate_pgw1191.py path constant and the stderr assertion.
• docs/releasing.md commands (gh workflow run ci.yaml --ref …), plus Taskfile and
  workflow comments.

CHANGELOG.md is deliberately untouched: its .yml mentions are dated historical records
of what those files were called at the time (and lanes do not edit the changelog).