Update wheel building workflow to only upload on actual release (#1870)

One pain point with Traits releases has been that we get as far as
making the release, only for the wheel build to fail.

This PR makes it easier to do a dry run of the wheel building _before_
making a release: the key change is that if the `release-to-pypi`
workflow is triggered via workflow dispatch, then wheel building is
performed but upload to PyPI is not performed.

This makes it harder to trigger a release via workflow dispatch, but I
think that's okay: we've almost never needed to do that, and in cases
where there's something that needs to be changed we can usually make a
new release.

Incidental changes:
- I've updated the Python version used for working with `build` and
`twine` to Python 3.13.

Author: mdickinson

.github/workflows/release-to-pypi.yml

@@ -9,7 +9,7 @@ jobs:
   build-wheels:
     strategy:
       matrix:
-        os: [windows-latest, macos-13, macos-14, ubuntu-latest]
+        os: [windows-latest, macos-15-intel, macos-latest, ubuntu-latest]
 
     runs-on: ${{ matrix.os }}
 
@@ -21,21 +21,23 @@ jobs:
     - name: Set up Python
       uses: actions/setup-python@v6
       with:
-        python-version: '3.10'
+        python-version: '3.13'
 
     - name: Install Python packages needed for wheel build and upload
       run: python -m pip install twine
 
     - name: Build wheels
       uses: pypa/cibuildwheel@v3.3.0
 
-    - name: Check and upload wheels
+    - name: Check wheels
+      run: python -m twine check --strict wheelhouse/*.whl
+
+    - name: Publish wheels to PyPI
+      if: github.event_name == 'release'
+      run: python -m twine upload wheelhouse/*.whl
       env:
         TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
         TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-      run: |
-        python -m twine check --strict wheelhouse/*.whl
-        python -m twine upload wheelhouse/*.whl
 
   build-sdist:
     runs-on: ubuntu-latest
@@ -48,18 +50,20 @@ jobs:
     - name: Set up Python
       uses: actions/setup-python@v6
       with:
-        python-version: '3.10'
+        python-version: '3.13'
 
     - name: Install Python packages needed for sdist build and upload
       run: python -m pip install build twine
 
     - name: Build sdist
       run: python -m build --sdist
 
+    - name: Check sdist
+      run: python -m twine check --strict dist/*
+
     - name: Publish sdist to PyPI
+      if: github.event_name == 'release'
+      run: python -m twine upload dist/*
       env:
         TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
         TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-      run: |
-        python -m twine check --strict dist/*
-        python -m twine upload dist/*