Switch release-please.yml to PyPI Trusted Publishing (OIDC)

## Summary The `release-please.yml` workflow added in #1168 / #1169 already has the full scaffolding for PyPI Trusted Publishing (OIDC): - `permissions: id-token: write` - `environment: pypi` with `url: https://pypi.org/p/pysr` …but both `pypa/gh-action-pypi-publish` steps still pass `password: ${{ secrets.PYPI_API_TOKEN }}` / `TEST_PYPI_API_TOKEN`, so the actual publish short-circuits OIDC and keeps long-lived PyPI tokens in repo secrets. ## Why PyPI recommends Trusted Publishing for all new projects, and the rest of the setup is already in place here — the only missing pieces are (1) removing the `password:` parameter and (2) registering the publisher on PyPI / Test PyPI. This removes a high-value long-lived secret from the repo's attack surface at essentially zero cost. ## Change (sketch) ```diff - name: Publish distribution 📦 to Test PyPI uses: pypa/gh-action-pypi-publish@release/v1 with: - password: ${{ secrets.TEST_PYPI_API_TOKEN }} repository-url: https://test.pypi.org/legacy/ skip-existing: true verbose: true - name: Publish distribution 📦 to PyPI uses: pypa/gh-action-pypi-publish@release/v1 with: - password: ${{ secrets.PYPI_API_TOKEN }} verbose: true ``` ## Maintainer-only step Before (or along with) merging the above, register Trusted Publishers on PyPI and Test PyPI: - Owner: `MilesCranmer` - Repository: `PySR` - Workflow: `release-please.yml` - Environment: `pypi` After the first successful trusted-publish, the `PYPI_API_TOKEN` and `TEST_PYPI_API_TOKEN` secrets can be rotated / deleted. Happy to send the tiny PR once you've decided whether you want the registration done first (safer) or in tandem. If you'd prefer to keep token-based auth for now, feel free to close this — just wanted to flag that the OIDC scaffolding is already sitting there unused.