Validate wheel NAME/VERSION before use in git commands in python-release.yml

[Copilot]

NAME and VERSION extracted from wheel filenames were flowing into git tag, git log, and shell constructs without format validation. A malformed build output or CI misconfiguration could introduce unexpected values.

Summary

Adds a format validation guard immediately after NAME/VERSION extraction in the release loop. Any wheel whose filename fields don't match the expected patterns is skipped with a ::error:: annotation rather than passed to git commands.

if [[ ! "$NAME" =~ ^[a-zA-Z0-9_-]+$ ]] || [[ ! "$VERSION" =~ ^[0-9a-zA-Z._-]+$ ]]; then
  echo "::error::Unexpected wheel name/version format in '${BASENAME}' — skipping." >&2
  continue
fi

Testing

• Not run (why?)
• uv run poe check
• Other: CodeQL scan — 0 alerts

Checklist

• Linked issue or task reference
• Added/updated tests where relevant
• Updated docs/README if needed
• No secrets or sensitive data added
• Considered backward compatibility and deployment impact

Additional context

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.