Complete PyPI trusted publishing for honua-sdk and honua-admin

[mikemcdougall]

Problem

The repository already contains package metadata, release tags, GitHub releases, and a publish-python-sdk.yml workflow using PyPI Trusted Publishing. However, both public registry endpoints currently return 404:

• https://pypi.org/pypi/honua-sdk/json
• https://pypi.org/pypi/honua-admin/json

As a result, the website must continue to describe the Python SDK as a source preview even though repository releases are present.

Scope

• Determine why tagged releases did not produce public PyPI projects (for example, missing trusted-publisher configuration, dry-run dispatches, workflow failures, or tag/version drift).
• Configure PyPI Trusted Publishers for both honua-sdk and honua-admin against the exact repository/workflow/environment.
• Verify least-privilege id-token: write publication and remove any need for long-lived upload secrets.
• Correct malformed or ambiguous release tags such as the existing python-sdk-vv* tags without rewriting published history.
• Validate package metadata and dependency ordering so honua-sdk publishes before honua-admin.
• Run clean wheel/sdist builds, compatibility gates, and install/import/CLI smoke tests.
• Publish new immutable prerelease or release versions from matching tags.
• Attach distributions and registry links to the corresponding GitHub releases.

Acceptance criteria

• Both PyPI JSON endpoints resolve.
• pip install honua-sdk==<version> succeeds in a clean supported Python environment.
• pip install honua-admin==<version> succeeds after resolving its published honua-sdk dependency.
• Imports and console entry points pass clean-install smoke tests across the declared Python support window.
• Published versions exactly match their immutable release tags and package metadata.
• The workflow fails before upload on tag/version mismatch, package validation failure, test failure, or missing dependency publication.
• Publication uses PyPI OIDC trusted publishing with least-privilege permissions.
• GitHub releases include wheel/sdist artifacts, PyPI links, and install/upgrade notes.
• The honua-site availability record is updated only after registry and clean-install evidence passes.

Notes

The current repository metadata reports honua-sdk 0.1.9 and honua-admin 0.1.6, but this issue should publish a new version if any packaging or workflow change is required; do not overwrite an immutable release version.

[mikemcdougall]

Released. Both packages are live on PyPI via Trusted Publishing:

• honua-sdk 0.1.10 — https://pypi.org/project/honua-sdk/
• honua-admin 0.1.7 — https://pypi.org/project/honua-admin/

What shipped to get here:

• Publish smoke-test path fixed after the monorepo restructure (ci: fix publish smoke test path after monorepo restructure #189).
• PyPI long_description / metadata refresh landed before the release so the artifacts froze the corrected pages (docs: pre-PyPI README refresh for release-frozen long_descriptions #190): alpha notice, real examples, all extras, ArcPy migration docs, Homepage → honua.io.
• Publish jobs bound to per-package GitHub environments pypi-honua-sdk / pypi-honua-admin (ci: bind PyPI publish jobs to per-package environments #191) because PyPI rejects two pending publishers with an identical repo/workflow/environment tuple; the registered publishers use those environment names.
• Release PR chore: release trunk #153 merged (honua-sdk 0.1.10 + honua-admin 0.1.7); publish runs 30982072279 and 30982218988 both green; pip install honua-sdk honua-admin from PyPI verified importable.

Ongoing release procedure: merge the release-please PR, then gh workflow run publish-python-sdk.yml -f package=honua-sdk before -f package=honua-admin (release tags use GITHUB_TOKEN and cannot trigger the workflow themselves). The pending publishers converted to project publishers on first upload — verify project ownership looks right in PyPI project settings. honua-gp / honua-arcpy remain Private :: Do Not Upload by design.