ci: publish PyPI through OIDC

[mstuart]

Summary

• replace the long-lived PYPI_TOKEN path with PyPI trusted publishing
• grant id-token: write only to the publish job
• preserve the existing wheel and sdist artifacts and idempotent skip-existing behavior
• pin every external action in python.yml to the exact commit behind its existing ref

PyPI prerequisite

The tare-compress project does not currently exist on PyPI, so configure this pending publisher before the workflow is used:

• project name: tare-compress
• provider: GitHub Actions
• organization/user: mstuart
• repository: tare
• workflow filename: python.yml
• environment: none (leave blank)

A pending publisher does not reserve the project name. Its first successful OIDC publish creates the project and converts the pending publisher into a normal trusted publisher. This PR does not configure PyPI or publish a release.

Verification

• actionlint 1.7.12
• immutable action-ref and focused PyPI OIDC invariant checks
• Python 3.11 integration tests: 11 passed
• release wheel and sdist builds