[ci] publish.yml — switch from OIDC trusted publishing to API token

Why: Run #26500551525 reached the publish step (tests now pass after
test_serve.py quarantine in iter f89ecec) but failed with
'invalid-publisher: valid token, but no corresponding publisher'. PyPI
trusted publishing requires a trusted-publisher rule on the PyPI
project side matching the workflow's OIDC claims (repository,
workflow_ref, environment) — that rule hasn't been configured.

Switching to API token auth (PYPI_API_TOKEN secret set on the repo
2026-05-27 from deploy/.credentials/pypi_credentials.sh). Trusted
publishing remains the preferred long-term path; comment in workflow
documents the migration trigger.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: RobLe3

.github/workflows/publish.yml

@@ -76,8 +76,12 @@ jobs:
         run: pip install build --quiet
       - name: Build sdist and wheel
         run: python -m build
-      - name: Publish to PyPI (trusted publishing)
+      - name: Publish to PyPI (API token)
         uses: pypa/gh-action-pypi-publish@release/v1
-        # Falls back to API token if OIDC trusted publishing is not configured:
-        # with:
-        #   password: ${{ secrets.PYPI_API_TOKEN }}
+        # API token auth — OIDC trusted publishing is not yet configured on
+        # the PyPI project side (would need a trusted-publisher rule matching
+        # workflow_ref=publish.yml@refs/tags/v0.5.x + environment=pypi).
+        # When the trusted publisher is configured, remove the `with:` block
+        # and uncomment `id-token: write` to fall back to OIDC.
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}