ci(release): restore production PyPI trusted publishing

[fishmingyu]

Objective

Restore secretless production releases after the one-time v0.1.0 bootstrap publication.

Context

The v0.1.0 tag release matrix passed, but PyPI rejected the final OIDC exchange with invalid-publisher because no matching production publisher was registered. The release was completed using the preconfigured account token and the exact artifacts from tag run 30444836310.

PyPI expected these claims:

• Project: codenib
• Owner: sysevol-ai
• Repository: CodeNib
• Workflow: release.yml
• Environment: pypi

Completion Criteria

• Add the GitHub trusted publisher under the production codenib project on pypi.org.
• Confirm the publisher fields exactly match the claims above.
• Rotate or revoke the bootstrap API token stored in ~/.pypirc after the publisher is active.
• Verify the next production release publishes through OIDC without a password or API token.

Evidence

• Failed OIDC exchange after all release gates passed: https://github.com/sysevol-ai/CodeNib/actions/runs/30444836310
• Published package: https://pypi.org/project/codenib/0.1.0/
• GitHub prerelease: https://github.com/sysevol-ai/CodeNib/releases/tag/v0.1.0

[fishmingyu]

Interim production path landed in #385. The pypi environment now holds PYPI_API_TOKEN, tagged releases pass it explicitly to pypa/gh-action-pypi-publish, and the workflow test locks that boundary. Main CI and Release are green at a42eb2b; the v0.1.0 deployment was reconciled to success after verifying the published artifact hashes.

This issue remains open only for the later migration back to secretless Trusted Publishing and token revocation.