Derive version from git tag and publish to PyPI via OIDC

[zanjonke]

Summary

Fixes the failing PyPI publish workflow and makes releases fully tag-driven.

Previously the workflow tried to sed a version = line into pyproject.toml that didn't exist (the version was dynamic), then git commited with nothing staged — which failed the job. This replaces that with a clean, conventional setup.

Changes

• pyproject.toml — build with hatch-vcs; the version is sourced from the git tag ([tool.hatch.version] source = "vcs"). Removed the _version.py path source.
• _version.py — deleted. No longer stored in the repo; the version comes from the git tag at build time.
• system_config.py — client_version now resolves from installed package metadata (importlib.metadata), falling back to the highest git tag for uninstalled source checkouts.
• .github/workflows/publish-to-pypi.yml —
  • release-triggered only (removed the manual workflow_dispatch/version-input path),
  • least-privilege permissions (top-level {}, opt-in per job),
  • publishes via PyPI Trusted Publishing (OIDC) using pypa/gh-action-pypi-publish instead of a long-lived PYPI_API_TOKEN.

The PyPI Trusted Publisher (owner Codeplain-ai, repo codeplain, workflow publish-to-pypi.yml, environment pypi) is already registered.

Release procedure after this merges

Publish a GitHub Release with tag vX.Y.Z (higher than what's on PyPI) → the workflow builds with that version and publishes to PyPI. No secrets, no manual version bumps.

Verification

• uv build on a clean tag checkout produces the exact tag version (verified end-to-end).
• Clean pip install of the built wheel → codeplain --version reports the correct version (via package metadata).
• black, isort, flake8, mypy, and the test suite all pass.

Testing recommendation

Cut a pre-release vX.Y.Zrc1 first (marked pre-release) to exercise the full OIDC pipeline without affecting normal pip install users.

[pedjaradenkovic]

I think this is good to go!