ci: add PyPI publish workflow

[Copilot]

Adds a GitHub Actions workflow to build and publish the package following the PyPA CI/CD publishing guide.

Changes

• New workflow .github/workflows/publish-to-pypi.yml:
  • build job: uses uv build to produce distributions, uploads as artifacts; scoped to contents: read only
  • publish-to-testpypi job: triggered on every push to main; downloads artifacts and publishes to https://test.pypi.org/legacy/ via pypa/gh-action-pypi-publish using the testpypi environment
  • publish-to-pypi job: triggered on GitHub release publication; publishes to production PyPI via pypa/gh-action-pypi-publish using the pypi environment
  • OIDC trusted publishing for both jobs (id-token: write); no API tokens required
  • All actions pinned to SHA digests, consistent with existing workflows and the Renovate helpers:pinGitHubActionDigests preset

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[deviantintegral]

@copilot add the job based on the linked pypi docs to also push releases to the production pypi instance.

[Copilot]

@copilot add the job based on the linked pypi docs to also push releases to the production pypi instance.

Added in 26e4625. The workflow now also triggers on release: types: [published] and runs a publish-to-pypi job (using the pypi environment with OIDC) that publishes to production PyPI when a GitHub release is published. The publish-to-testpypi job is gated to push events only.