Switch PyPI publishing from API token to OIDC trusted publishing

- Add permissions.id-token: write to publish workflow
- Remove --token flag from uv publish (uv auto-detects OIDC in GH Actions)
- Remove PYPI_TOKEN env var from workflow

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Prathamesh Juvatkar

.github/workflows/publish-pypi.yml

@@ -12,6 +12,8 @@ jobs:
   publish:
     name: publish
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
 
     steps:
       - uses: actions/checkout@v6
@@ -24,5 +26,3 @@ jobs:
       - name: Publish to PyPI
         run: |
           bash ./bin/publish-pypi
-        env:
-          PYPI_TOKEN: ${{ secrets.DOCSTRANGE_PYPI_TOKEN || secrets.PYPI_TOKEN }}

bin/publish-pypi

@@ -4,4 +4,4 @@ set -eux
 rm -rf dist
 mkdir -p dist
 uv build
-uv publish --token=$PYPI_TOKEN
+uv publish