ci: never publish pre-releases to PyPI

Pre-release tags host pinned wasm artifacts (pure-wheel.yml); the PyPI
upload must only run for real releases. Guard is per-job because uploads
happen per-job — a pre-release partially published 7.6.6.dev0 before its
linux legs failed.

Author: sspickle

.github/workflows/upload_pypi.yml

@@ -2,10 +2,17 @@ name: Upload Python wheel to PyPI
 
 on:
   release:
+    if: ${{ !github.event.release.prerelease }}
     types: [created]
 
+# Pre-releases exist to host pinned artifacts (see pure-wheel.yml) — they must
+# NEVER publish to PyPI. Guarded per-job because uploads happen per-job: on
+# 2026-08-15 a pre-release tag partially published 7.6.6.dev0 (sdist + mac/win
+# wheels) before the linux legs failed.
+
 jobs:
   wheels:
+    if: ${{ !github.event.release.prerelease }}
 
     strategy:
       max-parallel: 4
@@ -40,6 +47,7 @@ jobs:
         twine upload dist/*.whl
 
   linux_wheels:
+    if: ${{ !github.event.release.prerelease }}
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
@@ -71,6 +79,7 @@ jobs:
         twine upload dist/vpython-*-manylinux*.whl
 
   linux_aarch64_wheels:
+    if: ${{ !github.event.release.prerelease }}
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
@@ -100,6 +109,7 @@ jobs:
         twine upload dist/vpython-*-manylinux*.whl
 
   sdist:
+    if: ${{ !github.event.release.prerelease }}
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7