fix: make the release publishable and the adapter type-visible

[cayossarian]

Fixes the review findings that would have bitten on publish, plus the two
medium-severity ones. Targets develop — prototype work, nothing on main.

Blocker: the release workflow could not publish this repo

release.yml was never updated for the two-distribution layout. It ran
uv build (root only) and sed-ed the version into the root pyproject.toml
only. Publishing 3.0.0b1 today would have put span-panel-api on PyPI with
no adapter package, so every install connects and then raises
SpanPanelAdapterMissingError — and the package that fixes it would not exist.
The changelog's own pip install span-panel-api span-panel-api-schema-0 would
have failed on the second name.

A tag now selects a distribution instead of setting a version:

Tag	Publishes
v3.0.0b1	span-panel-api
schema-0-v1.0.0b1	span-panel-api-schema-0

The job resolves the distribution from the tag, verifies the tagged version
against the one committed in that distribution's pyproject.toml, and builds
only that package so dist/ cannot pick up a sibling.

Stamping the version at release time is not extensible to two packages, and
under this layout it is actively wrong: the adapter declares a floor on the
bootstrap (span-panel-api>=3.0.0b1,<4.0), so both committed versions
participate in resolution and are no longer placeholders a release can
overwrite. This does change the maintainer ritual to bump-commit-then-tag, with
a mismatch failing loudly rather than publishing a surprise.

Tag parsing was exercised against v3.0.0b1, v2.6.4, schema-0-v1.0.0b1,
multi-digit majors, and malformed tags (1.2.3, nightly), which are rejected
with a message naming both accepted forms.

High: the adapter distribution shipped untyped

py.typed did not travel with the parser when it moved out of
src/span_panel_api/, which has one. Confirmed against installed wheels in a
clean venv, under mypy --strict:

before: error: Skipping analyzing "span_panel_api_schema_0": module is installed,
               but missing library stubs or py.typed marker  [import-untyped]
        note: Revealed type is "Any"

after:  note: Revealed type is "span_panel_api_schema_0.adapter.SchemaZeroAdapter"
        note: Revealed type is "list[str]"
        Success: no issues found in 1 source file

Fully annotated, --strict-clean code resolving as Any for every consumer
defeats the point of the typing work. Both CI and the release job now fail any
wheel built without the marker, and tests/test_packaging.py asserts it from
the manifests so an adapter added under packages/ is covered the day it
exists.

Medium: duplicated adapter key

factory.py returned the literal "schema_0" while client.py used
DEFAULT_ADAPTER_KEY. Two sources of truth for the key that the only two
callers of resolve_adapter must agree on — and a divergence is invisible in a
dev workspace where every adapter is installed, surfacing only as an
unresolvable key in a real install.

Medium: conformance checking depended on member kind

_REQUIRED_MEMBERS screened vars() for callable, which reads as "every
declared member" and is not: a property object is not callable and neither is
a classmethod object, so either would have silently stopped being required the
day the protocol declared one. The comment claimed the stronger guarantee.

Kind filtering is dropped entirely — every public name in a Protocol's vars()
is a declared member, since Protocol's own machinery is uniformly
underscore-prefixed (verified by introspection). The derivation is extracted
into _derive_required_members(protocol) so the rule is testable against a
synthetic protocol declaring one of each kind, rather than asserted in prose.

Verification

• 432 tests pass (+6), coverage 94%, all pre-commit hooks green.
• Both new guards were mutation-checked: removing py.typed and restoring the
  callable filter each fail their test.