ci: add PyPI trusted publishing workflow

[CoderDeltaLAN]

Summary:

• Adds a PyPI Trusted Publishing workflow prepared for the final release path.
• Uses release: published as the only trigger.
• Uses the pypi environment and id-token: write for OIDC publishing.
• Does not use PyPI tokens, usernames, passwords, or GitHub secrets.

Verification:

• Pre-push strong check passed.
• Full local check passed: 118 tests, Ruff, text hygiene, git whitespace.
• Static workflow guards passed: no workflow_dispatch, no pull_request trigger, no push trigger.
• Release ref guard simulation passed for matching v0.2.1 and rejected mismatched v9.9.9.
• Secret scan passed for the workflow.

Scope:

• .github/workflows/publish-pypi.yml

Not included:

• No README final update.
• No tag creation.
• No GitHub Release publication.
• No PyPI publication.
• No release asset upload.

Release gate note:

• Final release must stop until GitHub environment pypi is created/verified and protected.