Document PyPI trusted publisher mismatch behind failing pypi-publish job (no code change)

[Copilot]

The pypi-publish job for the v1.9.0 tag failed at the OIDC token exchange with invalid-publisher. GitHub issued a valid token, but PyPI has no trusted publisher whose claims match it.

This PR contains no file changes. The workflow is configured correctly, and the cause is the PyPI project's publisher settings, which can't be changed from the repo.

Claims PyPI received

• repository: nextgenusfs/funannotate
• workflow_ref: .github/workflows/python-publish.yml@refs/tags/v1.9.0
• environment: pypi

Required action (PyPI, by a project owner)

In the funannotate project, go to Manage → Publishing, and add or correct a GitHub trusted publisher with:

Field	Value
Owner	nextgenusfs
Repository	funannotate
Workflow filename	python-publish.yml
Environment	pypi

If a publisher already exists, its workflow filename or environment name is probably different. After fixing it, re-run the failed job. It will use the same tag and the same built distributions.

Open question for reviewers

If the PyPI publisher is registered under a different workflow filename or environment, tell me which values. I can then change python-publish.yml to match instead of changing PyPI.

[hyphaltip]

@nextgenusfs take a look - I think we need to do something else to get pypi pkgs pushing