ci: add release-triggered PyPI publish workflow (OIDC, reviewer-gated)

[tangym]

Summary

Adds .github/workflows/publish-pypi.yml — a release-triggered workflow that publishes assert-ai to TestPyPI and PyPI via PyPA Trusted Publishing (OIDC).

Triggers

• release: published — primary path
• workflow_dispatch with a target choice (testpypi / pypi) for manual re-publish or retry

Jobs

1. build — checks out the release tag, builds wheel + sdist, runs twine check --strict, uploads dist/ as an artifact.
2. attach-release-assets — attaches the wheel + sdist to the GitHub Release as downloadable assets.
3. publish-testpypi — uses the testpypi environment. Runs on every release event (and on dispatch when target=testpypi). skip-existing: true so re-runs of the same version are no-ops.
4. publish-pypi — uses the pypi environment with a required reviewer. Runs only on non-prerelease releases (and on dispatch when target=pypi). The prerelease == false guard means an rc release uploads to TestPyPI only.

Auth

Trusted Publishing only — no PyPI tokens, no secrets in this repo.

To activate, a maintainer needs to register the following pending publishers on pypi.org and test.pypi.org:

Field	pypi.org	test.pypi.org
PyPI project	assert-ai	assert-ai
Owner	responsibleai	responsibleai
Repository	ASSERT	ASSERT
Workflow	publish-pypi.yml	publish-pypi.yml
Environment	pypi	testpypi

And create matching GitHub environments under repo Settings → Environments:

• testpypi — no protection rules
• pypi — required reviewer (e.g. release manager)

Safety

This workflow is inert when merged:

1. It only fires on a published GitHub Release, and no Release exists yet.
2. PyPI Trusted Publishing requires the pending publisher to be registered — until then the upload step fails closed.
3. The pypi environment requires reviewer approval before the upload step runs.

All three gates must be in place for a real publish to happen.

Companion

Builds on top of the wheel build hardening from #182, which already exercises python -m build + twine check on every PR.

[Copilot]

Pull request overview

Adds a new GitHub Actions workflow that builds assert-ai distributions and publishes them to TestPyPI (always on release) and PyPI (only for non-prerelease releases or manual dispatch) via PyPA Trusted Publishing (OIDC), with a separate job that attaches the wheel/sdist to the GitHub Release. The workflow is gated by GitHub environments (testpypi, pypi), where the pypi environment is intended to require reviewer approval.

Changes:

• New .github/workflows/publish-pypi.yml triggered on release: published and workflow_dispatch (with target choice).
• Build job (PEP 517 + twine check --strict) produces a dist artifact reused by all downstream jobs.
• Separate attach-release-assets, publish-testpypi, and publish-pypi jobs, with the PyPI job gated on build success, TestPyPI success/skip, and release.prerelease == false.