[codex] migrate CI from CircleCI to GitHub Actions

[streeter]

Summary

• Replace CircleCI with a GitHub Actions workflow for Python 3.11 linting and tests.
• Remove Python 2 package metadata and declare Python 3-only support.
• Move tag-based PyPI publishing to GitHub Actions and fail before publishing when PYPI_PASSWORD is not configured.
• Replace the CircleCI README badge with a GitHub Actions badge.
• Stabilize the historical receipt fixture test by validating its certificate chain at a fixed time within the fixture certificate validity window.
• Cap pyopenssl below 24 because the package still uses the legacy crypto.verify API.

Notes

The workflow checks for AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY before fetching the private S3 test fixtures, so missing fixture credentials fail clearly.

Validation

• ruby -e "require 'yaml'; YAML.load_file('.github/workflows/ci.yml')"
• python setup.py --name
• Clean worktree: python -m flake8
• Clean worktree: python -m pytest -q (10 passed, one crypto.verify deprecation warning)
• GitHub Actions CI run 28386500830 passed on commit 0956d97