Release workflow (release.yml) is triggered by v* tags and:
- gates everything on a version-consistency check across the five
  Cargo.toml files and reflectapi-python-runtime/pyproject.toml
- publishes the five Rust crates to crates.io in dependency order using
  Trusted Publishing (rust-lang/crates-io-auth-action@v1) — no
  long-lived CARGO_REGISTRY_TOKEN secret required
- builds the pure-Python reflectapi-runtime sdist + wheel via hatchling
  and publishes to PyPI via Trusted Publishing (pypa/gh-action-pypi-publish)
- cuts a GitHub Release with auto-generated notes; alpha/beta/rc tags
  are flagged as pre-releases automatically
- uploads the wheel + sdist as release assets

CI gains a python-runtime job that runs the runtime test suite (pytest)
on every push and pull request. Adapted from the awa repo's release.yml.

Before the first tag, the repo needs a 'release' GitHub Environment
configured as the trusted publisher for both crates.io (one entry per
crate) and PyPI (project: reflectapi-runtime, workflow: release.yml,
environment: release).

…green

The new python-runtime CI job exposed 16 pre-existing failures unrelated
to SSE work. Fix them at the root rather than deselecting:

- Auth tests called auth.auth_flow(request) and discarded the generator,
  so the request mutation never ran. Wrap calls in next(...) so the
  yield body executes (16 sites across test_auth_negative_cases.py and
  test_edge_cases.py).
- hypothesis_strategies.strategy_for_type fell through to st.none() for
  bare collection types (dict, list, tuple, set) because get_origin()
  returns None for the unparameterised classes. Pydantic then rejected
  the generated None on a non-Optional field. Add explicit handling for
  the bare collections.
- test_make_request_with_json_data_still_works asserted 'headers' was
  absent from build_request kwargs, but the runtime passes headers=None
  when no headers model is supplied. Both forms mean 'no headers';
  relax the assertion to accept either.