fix: pin publish workflow Python version to avoid pygame source build failure

[dmccoystephenson]

Summary

• Pins publish.yml's actions/setup-python step to python-version: "3.13" instead of "3.x", matching the fix PR ci: run tests on push and pull request #14 already applied to test.yml.
• "3.x" currently resolves to Python 3.14 on ubuntu-latest. pygame only ships prebuilt wheels through cp313, so on 3.14 pip falls back to a from-source build, which fails on the runner (missing SDL/freetype dev headers — sdl-config: not found).
• publish.yml only runs on vX.Y.Z tag pushes, so this wasn't caught by any PR-gated CI, but it would break the "Smoke-test the built wheel" step (after the artifact is already built) on the next actual release tag.

No breaking change to the Graphik public API — this is CI-only.

Test plan

• python3 -m compileall src/main/python
• pip install -e .
• pytest — 14 passed
• Workflow YAML change only; not runnable locally, but mirrors the exact fix already verified working in test.yml (PR ci: run tests on push and pull request #14, commit efcb8d4)

Closes #15

[dmccoystephenson]

Self-review: minimal, single-line change (plus explanatory comment) that mirrors the already-verified fix from PR #14 / test.yml exactly. No logic to break, no public API touched, local pytest suite passes (14/14). No issues found.