fix: add pypi release environment

[rlippmann]

Summary

• add the pypi environment to the Python publish workflow
• align GitHub Actions OIDC claims with the pending PyPI trusted publisher

Why

The first PyPI publish failed because the workflow did not emit the expected environment claim for trusted publishing.

Example metadata

• Enforcement point: N/A
• Domain: release automation
• Technology/runtime: GitHub Actions, PyPI trusted publishing
• Example type: repository maintenance
• Does this use directive drafter? should normally be no: no
• Does this derive state from model output? must be no for primary examples: no

Checklist

• Repository scaffolding / governance change
• One primary enforcement point
• Explicit authoritative state
• No model-derived state mutation
• Adversarial stub or equivalent test
• Observable runtime behavior change
• Domain vocabulary is natural
• Framework is secondary to the enforcement point
• Docs updated
• Tests/smoke checks added where practical

Notes

• Workflow-only change
• Next PyPI attempt should use a new tag such as v0.1.1