Fix upload_pypi: artifact download mismatch and missing release permission

[Copilot]

The upload_pypi job was failing because a workflow update introduced pattern: artifact_* for artifact download, which doesn't match the artifact uploaded as name: artifact — resulting in an empty dist/ and a PyPI publish failure.

Changes

• Artifact download (actions/download-artifact@v8): Restored name: artifact instead of pattern: artifact_*, which matched zero artifacts and caused the empty dist/ directory error.
• Job permissions: Added contents: write alongside id-token: write so softprops/action-gh-release can upload assets to the GitHub release. Specifying any permissions block drops all defaults, so without this the release asset upload would silently fail once PyPI publish succeeds.

# Before
pattern: artifact_*   # never matched "artifact"
merge-multiple: true
permissions:
  id-token: write     # contents: write dropped, breaking release upload

# After
name: artifact
permissions:
  id-token: write
  contents: write