Fix PyPI publish workflow trusted-publisher claim mismatch

[Copilot]

The publish GitHub Actions job failed during trusted publishing with invalid-publisher because the OIDC token subject included an environment-scoped claim that did not match the configured PyPI publisher. This change aligns the workflow identity claims with PyPI trusted publisher matching.

• Workflow identity alignment

  • Removed environment: pypi from the publish job in .github/workflows/publish.yml.
  • This drops the :environment:pypi suffix from the OIDC sub claim used by pypa/gh-action-pypi-publish, allowing publisher matching against the repository/workflow identity.

• No behavioral changes outside publish auth

  • Build and upload steps remain unchanged.
  • Only the claim shape used for PyPI trusted publishing is adjusted.

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      id-token: write

[mzargham]

this fix makes sense to me.