Only run GH Action when we push a `vX.Y.Z` tag

[eob]

Right. now it runs (and fails) on non-release pushes

Context: PYPI packaging and deployment is done automatically when we push a tag called vX.Y.Z