Align release verify step with socket-sdk-python hardening

Use python -m pip with an explicit production Simple-index URL, quote
workflow outputs, and skip the sleep after the final attempt, matching
the socket-sdk-python release workflow so the verify step is identical
in both repos.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

Author: lelia

.github/workflows/release.yml

@@ -79,25 +79,32 @@ jobs:
         env:
           VERSION: ${{ env.VERSION }}
         run: |
-          # PyPI's simple index is CDN-cached and can lag a successful upload
-          # by 10+ minutes when a cache purge is delayed (both socketsecurity
-          # 2.5.9 and socketdev 3.4.2 hit this on 2026-08-05), so retry for up
-          # to 30 minutes and use --no-cache-dir so each attempt refetches the
-          # index instead of revalidating a stale copy from pip's HTTP cache.
-          for i in {1..60}; do
-            if pip install --no-cache-dir socketsecurity==${VERSION}; then
+          # The first lookup can race PyPI's Simple-index propagation, and a delayed
+          # CDN purge can leave the index stale for 10+ minutes after a successful
+          # upload (socketsecurity 2.5.9 and socketdev 3.4.2 both hit this on
+          # 2026-08-05). pip caches HTTP responses by default, so without
+          # --no-cache-dir every retry can reuse that initial stale response instead
+          # of checking whether the release has appeared. Budget: 30 minutes.
+          MAX_ATTEMPTS=60
+          for i in $(seq 1 "$MAX_ATTEMPTS"); do
+            if python -m pip install \
+              --no-cache-dir \
+              --index-url https://pypi.org/simple/ \
+              "socketsecurity==${VERSION}"; then
               echo "Package ${VERSION} is now available and installable on PyPI"
-              pip uninstall -y socketsecurity
-              echo "success=true" >> $GITHUB_OUTPUT
+              python -m pip uninstall -y socketsecurity
+              echo "success=true" >> "$GITHUB_OUTPUT"
               exit 0
             fi
             if curl -s -f "https://pypi.org/pypi/socketsecurity/${VERSION}/json" > /dev/null; then
-              echo "Release ${VERSION} exists on PyPI (JSON API) but is not in the simple index yet - CDN propagation delay"
+              echo "Release ${VERSION} exists on PyPI (JSON API) but is not in the Simple index yet - CDN propagation delay"
+            fi
+            if [ "$i" -lt "$MAX_ATTEMPTS" ]; then
+              echo "Attempt $i: Package not yet installable, waiting 30s... (${i}/${MAX_ATTEMPTS})"
+              sleep 30
             fi
-            echo "Attempt $i: Package not yet installable, waiting 30s... (${i}/60)"
-            sleep 30
           done
-          echo "success=false" >> $GITHUB_OUTPUT
+          echo "success=false" >> "$GITHUB_OUTPUT"
           exit 1
 
       - name: Build & Push Docker