Fix PyPI trusted publishing by adding required pypi environment to publish job

[Copilot]

The publish Actions job failed to exchange its OIDC token with PyPI (invalid-publisher) because the token claims were missing the expected environment. This updates the workflow so token claims align with the trusted publisher configuration.

• Root cause

  • publish.yml job emitted OIDC claims without environment, while PyPI trusted publishing expects a matching environment-scoped publisher.

• Workflow change

  • Added environment: pypi to the publish job in .github/workflows/publish.yml.
  • This ensures GitHub includes the environment claim in the OIDC token used by pypa/gh-action-pypi-publish.

• Resulting behavior

  • Tag-triggered publish runs now present claims compatible with the repository’s PyPI trusted publisher mapping.

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write