Add automated PyPI deployment with trusted publishing

[Copilot]

Implements automated package building and PyPI deployment as requested in the issue. Builds are triggered on all PRs and commits to main; deployment occurs only on tag pushes.

Changes

• .github/workflows/publish.yml: GitHub Actions workflow

  • Builds package with python -m build on all events
  • Publishes to PyPI on tag push using OIDC trusted publishing
  • Artifacts stored for verification
  • Minimal permissions (contents: read for build, id-token: write for publish)

• .github/PYPI_SETUP.md: Setup instructions

  • PyPI trusted publisher configuration steps
  • Release process documentation

Usage

After configuring trusted publishing on PyPI (see .github/PYPI_SETUP.md):

git tag v0.3.0
git push origin v0.3.0

No API tokens required - authentication via GitHub OIDC.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Add automated deployment to PyPI with trusted publishing</issue_title>
<issue_description>Once #4 is merged I'll assign this to copilot and I'm pretty sure it'll be able to take care of it easily with the usual python -m build for all PRs/commits to main with detection of if it's a tag in which case it should deploy the sdist/bdist to PyPI.</issue_description>

Comments on the Issue (you are @copilot in this section)

@AndyLHCb @chrisburr #4 is merged

• Fixes Add automated deployment to PyPI with trusted publishing #5

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.