ci: gate publish on cross-platform tests; bump dep floors

[vietanhdev]

Summary

• Adds .github/workflows/tests.yml — a 3×3 matrix (Ubuntu/Windows/macOS × Python 3.11/3.12/3.13) that runs pip install . and the unit suite. Reusable via workflow_call.
• Gates python-publish-cpu.yml, python-publish-gpu.yml, and release.yml on the matrix via needs: test. Tag-driven publishes now wait for tests across every supported Python and OS.
• Bumps action versions: actions/checkout v2/v3 → v4, actions/setup-python v4 → v5, conda-incubator/setup-miniconda v2 → v3.
• Raises pyproject.toml dependency floors to versions verified to install cleanly on all three Pythons; adds a missing huggingface_hub>=0.24.0 floor.
• Adds CLAUDE.md (six-step pre-publish playbook + architecture overview) and rewrites .cursorrules to mirror it.
• Fixes resource scripts post-PyQt6 migration. scripts/compile_languages.py and scripts/generate_languages.py shelled out to pyrcc5 / pyrcc6 — neither exists in PyQt6. Both have been broken since 9735fe8. Switch to pyside6-rcc + pyside6-lrelease and rewrite the generated imports back to PyQt6. Add PySide6-Essentials as a [dev] extra.
• Fixes the GPU publish path. The setup.py shim that overrides the package name to anylabeling-gpu is silently rejected by PEP 621 (pyproject.toml's [project].name is static). A tag push today would build anylabeling-0.4.x.whl and try to upload it via the anylabeling-gpu trusted-publisher token — PyPI would reject. Have the GPU workflow sed pyproject.toml directly before python -m build, and add a verify step that asserts the wheel filename + METADATA.

Why

anylabeling-gpu==0.4.30 shipped to PyPI broken (#227) because no automated step ran pip install . against current dep floors before publish. The fix landed on master, but nothing in CI would have caught the next similar regression. This PR closes that gap and surfaces two more pre-existing breakages on the way (resource scripts, GPU publish path).

What was actually verified

• 9-cell test matrix passes on this PR (Ubuntu/Windows/macOS × py3.11/3.12/3.13).
• Local install + unit suite + real-model inference on Python 3.11.15 / 3.12.13 / 3.13.9 against the bumped floors: MobileSAM (3 tests), SAM2 hiera-tiny (4 tests), SAM3 ViT-H (6 tests), YOLOv8n (3 tests).
• CPU wheel build (python -m build) produces Name: anylabeling, METADATA reflects bumped floors.
• GPU wheel build with the new sed step produces Name: anylabeling-gpu and Requires-Dist: onnxruntime-gpu>=1.20.0 (verified locally; before this PR the same steps produced Name: anylabeling).
• Resource scripts run end-to-end under PyQt6: python scripts/compile_languages.py rebuilds anylabeling/resources/resources.py and the full app import chain still loads.
• Publish workflows did NOT run on this branch push — python-publish-{cpu,gpu}.yml and release.yml are gated by on: push: tags: 'v*', so opening a PR cannot accidentally publish to PyPI.

What this PR does NOT exercise

The publish/release workflows only run on tag pushes, so the only true end-to-end proof of the gate + GPU rewrite is to push a real tag. Verified statically:

• python-publish-cpu.yml: build-n-publish declares needs: test.
• python-publish-gpu.yml: build-n-publish-gpu declares needs: test; new sed + verify steps confirm the wheel is anylabeling-gpu before upload.
• release.yml: release declares needs: test; build and build_macos_folder declare needs: [release].

Follow-ups (separate PRs)

• Delete the now-no-op setup.py shim — its name override is silently dropped by PEP 621; the pyproject.toml sed in CI is the authoritative mechanism now.
• Decide whether to delete .cursorrules (kept and rewritten in this PR).