Publish releases to PyPI via Trusted Publishing (deferred)

[smmaurer]

Summary

Adds a publish job to build-wheels.yml, split out of #201 (authored by @waddell). On a published GitHub release, it:

• waits for all wheel and sdist builds to succeed
• checks that the release tag matches the package version in setup.py
• runs twine check on the distributions
• uploads via pypa/gh-action-pypi-publish using OIDC — no stored API token — with id-token: write limited to this job
• pins the checkout, artifact-download, and PyPI-publish actions by commit SHA

Why draft

Prerequisites that aren't in place yet (see #199 and the UDST CI and Release Plan):

1. Protected pypi environment — the job references environment: pypi, which should require release-manager approval. The UDST org is on the legacy GitHub Silver plan, which doesn't support deployment environments; migrating the org plan is a one-time owner task.
2. Trusted Publisher registration on PyPI: owner UDST, repository pandana, workflow build-wheels.yml, environment pypi.
3. Repository settings — default workflow permissions should be read-only, workflows should not be able to approve PRs, and tag protection / rulesets should exist so a release can't be created from an arbitrary commit.

Until then, releases are uploaded manually with twine from the artifacts of the Build wheels workflow (see CONTRIBUTING.md). Rehearse the automated path with a release candidate before using it for a final release.