Added tag-driven release process

[joshterrill]

Combines two in-flight branches into a single 0.6.1 release line:

• josh/python3.14-upgrade — tag-driven release workflow, RELEASING.md,
  CI hygiene, refreshed poetry.lock, and a cast fix in variance_normalize
  for mypy.

Note: Python 3.14 was already supported and already in the test matrix as of
#56. This PR does not add 3.14 support — it quotes the matrix entries so YAML
parses them as strings, and advertises the supported versions via trove
classifiers.

Release process

• deploy now triggers on tags instead of every push to master. Release
  tags are bare version numbers (0.6.1, 0.6.1.dev0); a v prefix is matched
  only so the new verify-tag job can fail with an explanatory error.
• New verify-tag job checks that the tag matches pyproject.toml's version,
  and that final (non-pre-release) tags point at a commit on master.
• deploy is gated on both verify-tag and the full test matrix, so a red
  suite on the tagged commit blocks the upload. No --skip-existing: a
  duplicate version is a mistake worth failing on.
• RELEASING.md documents the whole flow.

CI hygiene

• Quote python-version matrix entries (3.11 → "3.11") so YAML doesn't
  parse them as floats.
• Bump actions/checkout v2 → v6 and actions/setup-python v4 → v6.
• Add Programming Language :: Python :: 3.11–3.14 classifiers.

Verification

• pytest — 73 passed
• mypy numerai_tools — no issues
• ruff check / ruff format --check — clean