🔧 Switch PyPI publishing to trusted publishing (OIDC)

[chrisjsewell]

Replace long-lived API token with PyPI trusted publishing via pypa/gh-action-pypi-publish. This uses short-lived OIDC credentials scoped to the CI workflow, eliminating the need for stored secrets.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.85%. Comparing base (36c5f54) to head (0a1db14).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #397   +/-   ##
=======================================
  Coverage   95.85%   95.85%           
=======================================
  Files          64       64           
  Lines        3619     3619           
=======================================
  Hits         3469     3469           
  Misses        150      150           

Flag	Coverage Δ
pytests	95.85% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.