ci: publish to PyPI via trusted publishing instead of an API token

[ryanhill1]

Matches qBraid/qBraid#1346, which does the same for the SDK.

The publish workflows authenticated to PyPI with PYPI_API_TOKEN, a long-lived
credential stored as a repository secret. This switches them to Trusted Publishing:
the job requests id-token: write, and pypa/gh-action-pypi-publish mints a
short-lived OIDC credential scoped to that one workflow. No publishing secret is
stored in the repository afterwards.

Trusted Publishing is also the prerequisite for PEP 740 attestations, which the
action generates by default. Those attach the repository, workflow and commit SHA
to each uploaded file, so a published wheel can be traced back to the commit that
built it. They apply to releases published after this merges, not retroactively.

Trusted publishing has been configured on PyPI for both release.yml and pre-release.yml

[argus-eye]

Argus review

Auto-review is off for this repo. Tick the box below to run a review on this PR.

• Trigger Argus review

Estimated cost

• Files changed: 2
• Diff lines (±): 12
• Historical avg: ~243.6k tokens · ~$0.95 · across last 10 review(s)

Tip: you can also comment @argus-eye review at any time.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 681b2c2f-69dc-4179-9b9c-e693e177ec38

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[TheGupta2012]

Seems like the publish step did not have the right permissions, I think you accidentally added them in publish sdist step.

I've added them in the publish-to-pypi flow but that led me to a bug in our pre-release workflow! Seems like we weren't updating the sdist names correctly for pre-releases. Raised the PR #413 for that, should fix it

[TheGupta2012]

Completed pre-release - https://github.com/qBraid/pyqasm/actions/runs/32821887958/job/97722479493

Had to bump to 1.2.0-alpha for the new pre-release