ci: one publish path per package, matching the registered publisher

PyPI matches a trusted publisher on repository, workflow filename and
environment, and this repo had two tag-triggered publish paths where only one
was registered. Every release would have fired both: one publishing, one failing
authentication, and the second to run also tripping "version already exists".

Collapsed to the registered path, and added the two guards it was missing —
twine check on the artifacts, and a refusal when that version is already on the
index, since PyPI does not allow a version to be replaced.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019d5ks2kCa4eXD1ftdkECPu

Author: kmjones1979

.github/workflows/ci.yml

@@ -53,5 +53,21 @@ jobs:
           pip install build
           python -m build
 
+      # PyPI will not let a version be replaced, so a bad or duplicate upload
+      # burns that version number permanently. Both checks run before the push.
+      - name: Check the artifacts
+        run: |
+          pip install twine
+          twine check dist/*
+
+      - name: Refuse a version that is already on PyPI
+        run: |
+          VERSION=$(python -c "import tomllib;print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          if curl -sf "https://pypi.org/pypi/oneclaw/$VERSION/json" >/dev/null 2>&1; then
+            echo "oneclaw $VERSION is already published. Bump the version in pyproject.toml."
+            exit 1
+          fi
+          echo "oneclaw $VERSION is not on PyPI yet."
+
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1