Add PyPI Trusted Publishing release workflow

[shihweilo]

Replaces token-based publishing with OIDC Trusted Publishing. No API token is
stored in the repository, in GitHub secrets, or on a maintainer's machine — a
leaked token can't be replayed because there is no token to leak.

Structure

Build and publish are separate jobs, per the PyPA action's guidance. The build
job runs with no elevated permissions; only the publishing job gets
id-token: write. Distributions pass between them as an artifact.

Trigger	Result
Push a tag matching v*	Build, then publish to PyPI
Manual run, target testpypi	Build, then publish to TestPyPI (dry run)
Manual run, target pypi	Build, then publish to PyPI

Signed PEP 740 attestations are generated by default under Trusted Publishing,
tied to the same OIDC identity that authorises the upload.

Tag/version guard

The build fails when a pushed tag doesn't match version in pyproject.toml:

tag=0.7.3 packaged=0.7.3     -> pass
tag=0.9.9 packaged=0.7.3     -> error, build stops

That exact mismatch is why 0.7.2 and 0.7.3 had to be cut as separate versions
instead of re-tagged. Worth catching mechanically rather than by memory.

Two steps needed before this can publish

Both are on your account and I can't do them.

1. Register the trusted publisher on PyPI — pypi.org → Your projects →
   tappay → Manage → Publishing → GitHub tab:

   Field	Value
   Owner	shihweilo
   Repository	tappay-python
   Workflow name	release.yml
   Environment	pypi

   Repeat on test.pypi.org with environment testpypi if you want the dry run.
   Requires owner access to the existing tappay project.

2. Create the pypi GitHub environment (Settings → Environments). Optional
   for function but strongly recommended: it lets you require manual approval
   before any publish actually runs. If you register an environment name on
   PyPI, the workflow must use the same one — it already does.

Publishing 0.7.3 once this lands

v0.7.3 points at e46d7f5, which predates this workflow, so re-pushing that
tag would not find it. Use a manual run with target pypi instead: it builds
master, which is the same commit plus this workflow, and .github/ is not
part of the sdist or wheel — so the artifacts are equivalent to those built at
the tag. Releases from 0.8.0 onward will publish automatically on tag push.

🤖 Generated with Claude Code