switch to dep groups (PEP 735)

I think `main.yml` should be more explicit about `python -m pip install hatch` as 1.16+ is definitely required. but I left it be for now. I ran with `uv run --with hatch --with twine hatch...` in order to test this, but ultimately want to open the PR to see if CI/CD will pass as well. it bothers me that `twine` needed to be added to `main.yml` but [3bef2e1](https://github.com/pyOpenSci/pyos-package-template/pull/145/commits/3bef2e1dcf1cb3189ebb5578e287251366f53698) didn't address it like I expected. somehow `hatch` is not properly handling the dep group for itself? If there's one "hack" "in this PR, that feel like it. perhaps `twine` belongs elsewhere. fixes #143