PR-F1: Trusted publish gate for PyPI workflow

[lmeyerov]

Summary

• Harden .github/workflows/publish-pypi.yml trusted-trigger behavior.
• Bind publish job to environment pypi-release so required reviewers can gate release execution.
• Add explicit trigger verification step:
  • tag publishes must point to commits in origin/master history
  • workflow_dispatch publishes allowed only from master
• Keep least-privilege publish permissions (contents: read, id-token: write).
• Add changelog entry for trusted release gate behavior.

Why

This is PR-F1 under umbrella #1130 and starts the trusted release hardening track now that GPU re-enable is deferred.

Ops Note

Configure required reviewers on environment pypi-release in repository settings for the approval gate to actively enforce human approval.

Validation

• local actionlint: pass
• local zizmor --min-severity high: pass

[lmeyerov]

Rebased/merged latest master into this branch and resolved the CHANGELOG conflict by preserving both entries (trusted publish gate + release docs/metadata).\n\nCurrent state: GitHub Actions checks are green; only external docs/readthedocs.org:pygraphistry is still pending.