chore(release): remove Private classifier + add PyPI Trusted Publishing workflow

[Zer0pa-Architect-Prime]

Summary

This PR removes the deliberate upload gate and wires up OIDC Trusted Publishing so the package can be released to PyPI.

Change 1 — pyproject.toml

Removes the single line:

"Private :: Do Not Upload",

This classifier was an intentional hold on public distribution. Its removal is operator-authorized (2026-05-03). No other content in pyproject.toml was touched.

Change 2 — .github/workflows/publish.yml (new file)

Adds a GitHub Actions workflow that fires on v* tags and publishes the built package to PyPI using PyPI Trusted Publishing (OIDC). There are no stored credentials, API tokens, or passwords — the workflow uses id-token: write to obtain a short-lived OIDC token that PyPI verifies against the registered Trusted Publisher slot for the package name cuneiform-control.

The environment: pypi block matches the environment name that must be registered in the PyPI Trusted Publisher settings for this repository.

What this does NOT do

• Does not push any release tag (that remains a manual operator action)
• Does not change the package version or any other metadata
• Does not add any runtime dependencies