Use PyPI Trusted Publishing for publishing releases

[limjoobin]

Summary

• Switch PyPI publishing to Trusted Publishing via GitHub OIDC.

---

Note

Medium Risk
Changes how production packages are authenticated and published; misconfigured PyPI Trusted Publishing or job permissions would block releases until fixed.

Overview
Release publishing no longer uses a long-lived PYPI secret with uv publish. The build-and-publish job now grants id-token: write (and contents: read) and uploads wheels/sdists with pypa/gh-action-pypi-publish@release/v1, which authenticates to PyPI through GitHub OIDC Trusted Publishing.

uv build is unchanged; only the upload step and job permissions differ.

^{Reviewed by Cursor Bugbot for commit dc048fa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[jit-ci]

🛡️ Jit Security Scan Results

✅ No security findings were detected in this PR

---

^{Security scan by Jit}