Add trusted PyPI publishing workflow

[aliengineering-byte]

What changed

• add a manual, main-only PyPI Trusted Publishing workflow for immutable GitHub Release assets
• require the selected tag, commit, version, and both SHA-256 hashes to match before upload
• isolate OIDC permission to the pypi publishing job and pin third-party actions
• make public PyPI installation the primary README path
• preserve the exact SciPy forum outreach copy in the existing upstream proposal

Why

PhaseProbe v0.2.0 is already released and verified on GitHub. This adds a narrowly scoped path to publish those exact artifacts to PyPI without long-lived credentials or rebuilding the release.

Validation

• actionlint .github/workflows/publish-pypi.yml
• python -m ruff format --check .
• python -m ruff check .
• python -m mypy src tests
• python -m pytest --cov=phaseprobe --cov-report=term (81 passed, 86.37% coverage)
• python -m build and Twine 7.0.0 checks
• package, link, hygiene, privacy, packed core-install, packed SciPy-install, replay, and generated-test checks
• public v0.2.0 asset hashes verified against the immutable GitHub Release