ci: guard the PyPI publish against a duplicate version

PyPI does not allow reusing a version number, so a publish of a version that is
already on the index fails at the index and a bad artifact cannot be replaced.
The check now happens before the upload, alongside a twine check of the built
artifacts.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019d5ks2kCa4eXD1ftdkECPu

Author: kmjones1979

.github/workflows/publish.yml

@@ -36,5 +36,14 @@ jobs:
           pip install twine
           twine check dist/*
 
+
+      - name: Refuse to publish a version that is already on PyPI
+        run: |
+          VERSION=$(python -c "import tomllib;print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          if curl -sf "https://pypi.org/pypi/oneclaw/$VERSION/json" >/dev/null 2>&1; then
+            echo "oneclaw $VERSION is already published. Bump the version in pyproject.toml."
+            exit 1
+          fi
+          echo "oneclaw $VERSION is not on PyPI yet."
       - name: Publish
         uses: pypa/gh-action-pypi-publish@release/v1