ci(publish): drop the TestPyPI target

[LukasParke]

Why

The TestPyPI rehearsal failed on its first real attempt:

invalid-publisher: valid token, but no corresponding publisher
  sub:         repo:OpenRouterTeam/python-agent:environment:testpypi
  environment: testpypi

The OIDC claims were exactly right. TestPyPI is a separate site with its own account and its own trusted-publisher config, so it needs a second registration that the pypi.org one doesn't cover.

That makes the rehearsal fail for a reason the real publish would not — which is worse than having no rehearsal, because it reports a problem that doesn't exist on the path that matters.

What the failed run did prove

Every other step passed, and those are the ones worth having:

Verify (lint, types, tests, coverage, required API)  success
Refuse to publish a version the port is ahead of     success   <- the guard, working
Build sdist and wheel                                success
Check metadata renders for PyPI (twine --strict)     success
Import the public API from the built wheel           success
Confirm this version is not already published        success
Publish to TestPyPI                                  FAILURE

All of those run under dry-run too — so the dry run already covers what the rehearsal was for: everything except the upload itself.

Changes

• Removed the target input, so the only input is dry-run
• Removed the Publish to TestPyPI step
• Removed the dual-index branch in the already-published guard (now always pypi.org)
• Replaced ${{ inputs.target }} in the environment, concurrency group, artifact name, and messages
• environment: pypi is now pinned directly, so the trusted-publisher identity is unambiguous
• PORTING.md's release procedure is 3 steps instead of 4, and documents why there's no rehearsal

The testpypi repo environment is left in place but unused — harmless, and removing it is a separate decision.

Verification

publish.yaml parses · single dry-run input · one publish step gated on dry-run == false · environment: pypi · verify.sh PASS (0 failures).

Note

0.8.0 is honest to publish once this lands — the ported commit 680bceb is upstream's @openrouter/agent@0.8.0 tag commit, which the ahead-of-release guard confirmed in the failed run (Ported tree is level with ... 0.8.0 is honest to publish).

Worth double-checking the pypi.org pending publisher uses environment pypi before the real run, since the TestPyPI failure showed how easy that field is to get wrong.

🤖 Generated with Claude Code