Switch PyPI publish to Trusted Publishing (OIDC)

Author: GRU-953

.github/workflows/release.yml

@@ -39,24 +39,17 @@ jobs:
   pypi:
     runs-on: ubuntu-latest
     needs: release
-    # Publishes only when a PyPI token secret is configured (skipped otherwise).
-    if: ${{ github.event_name == 'push' }}
+    # Publishes via PyPI Trusted Publishing (OIDC) — no token/secret required.
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
-      - name: Build
+      - name: Build wheel + sdist
         run: |
-          python -m pip install --upgrade pip build twine
+          python -m pip install --upgrade pip build
           python -m build
-      - name: Publish to PyPI (token)
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
-        run: |
-          if [ -n "$TWINE_PASSWORD" ]; then
-            twine upload --non-interactive dist/*
-          else
-            echo "PYPI_API_TOKEN not set — skipping PyPI publish."
-          fi
+      - name: Publish to PyPI (Trusted Publishing)
+        uses: pypa/gh-action-pypi-publish@release/v1