feat(packaging): nest protocol/ + ocf/ under smartthings_local, add PyPI packaging

Nest the two library packages under a single import namespace so they
can ship as one distribution:

  protocol/ -> smartthings_local/protocol/
  ocf/      -> smartthings_local/ocf/   (git mv, history preserved)

- Rewrite all imports protocol.* -> smartthings_local.protocol.*,
  ocf.* -> smartthings_local.ocf.* across the ocf modules, mqtt_demo/
  (bridge, descriptor, samples), and tests.
- Add pyproject.toml: dist name `smartthings-local`, hatch-vcs versioning
  from v* tags, wheel ships only smartthings_local/.
- Add .github/workflows/publish.yml: build + PyPI Trusted Publishing on
  v* tags (OIDC, no stored token).
- Force-include protocol/ocf_root_ca.pem via [tool.hatch.build] artifacts:
  it is tracked but matches .gitignore's *.pem, so hatchling's VCS file
  selection would drop it — and dtls_session.py loads it at runtime.
- Update mqtt_demo Dockerfile COPY and deploy.sh tar allowlist to the
  single smartthings_local/ package.
- .gitignore: build artifacts (_version.py, dist/, *.egg-info/).

Validated: pytest tests/ (11 passed), python -m build produces sdist +
wheel with the pem bundled, fresh pip install resolves all nested imports
with the pem readable from site-packages.

mqtt_demo/deploy.sh

@@ -22,7 +22,7 @@ set -e
 
 # This script lives in mqtt_demo/ but the build context is the repo
 # root (mqtt_demo/docker-compose.yml uses `context: ..`, since the
-# image needs the protocol/ and ocf/ library packages alongside
+# image needs the smartthings_local library package alongside
 # mqtt_demo/). Run everything from the repo root so the tar allowlist
 # and remote layout line up with that context.
 cd "$(dirname "$0")/.."
@@ -51,12 +51,11 @@ ssh "${SSH_HOST}" mkdir -p "${REMOTE_DIR}" "${APPDATA_DIR}"
 
 # Source code — explicit allowlist instead of an excludelist. Anything
 # else in the repo (research files, certs, logs, the .git dir) stays
-# local. protocol/ and ocf/ are the library packages mqtt_demo/ imports
-# from; they need to land as REMOTE_DIR's siblings of mqtt_demo/ so the
+# local. smartthings_local/ is the library package mqtt_demo/ imports
+# from; it needs to land as REMOTE_DIR's sibling of mqtt_demo/ so the
 # compose file's `context: ..` resolves the same way it does locally.
 COPYFILE_DISABLE=1 tar cz \
-    protocol/ \
-    ocf/ \
+    smartthings_local/ \
     mqtt_demo/ \
     README.md \
     .gitignore \