[build] Give Python release candidates distinct versions

[wuchong]

Summary

RC tags currently build the final Cargo version (1.0.0), so TestPyPI's skip-existing can silently retain files from an earlier candidate. Give each Python release candidate a distinct PEP 440 version: v1.0.0-rc3 produces pyfluss==1.0.0rc3.

Set static Python version metadata before both sdist and wheel builds. The sdist retains this version when rebuilt; Rust workspace versions and lockfiles stay unchanged, and final release tags retain the Cargo-derived version. Unsupported tag formats fail before changing metadata.

Test Plan

• actionlint, ruff check, ruff format --check, and git diff --check pass.
• Built real sdists for v1.0.0-rc2, v1.0.0-rc3, and v1.0.0; checked filenames and PKG-INFO versions 1.0.0rc2, 1.0.0rc3, and 1.0.0 respectively. Verified all four license files and unchanged Rust manifests/lockfile.
• Rebuilt a macOS ARM64 / Python 3.12 wheel from the RC3 sdist; checked its version and exact LICENSE/NOTICE contents, installed it, and successfully imported fluss and fluss._fluss with distribution version 1.0.0rc3.
• Built directly from the repository using the release workflow's Python binding working directory and maturin build --release --locked; verified wheel metadata is 1.0.0rc3.
• The preceding ASF Actions fix passed the full 20-wheel, sdist, and license matrix. The candidate version change was validated locally as above; no packages were published during validation.

AI-assisted changes.

Requires the separate ASF-approved Rust Action pin in #4410 before an upstream release workflow can run.

[fresh-borzoni]

LGTM 👍