ci: publish to PyPI from release-please workflow

Avoids GITHUB_TOKEN limitation where tag/release events created by the
bot cannot trigger separate workflows. Instead, the publish job runs
directly in the release-please workflow when release_created is true.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Chris1221

.github/workflows/release-please.yml

@@ -21,4 +21,31 @@ jobs:
         id: release
         with:
           release-type: python
-          package-name: yamldoc
+          package-name: yamldoc
+
+  publish:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created }}
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/yamldoc
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Pixi
+        run: |
+          curl -fsSL https://pixi.sh/install.sh | bash
+          echo "$HOME/.pixi/bin" >> $GITHUB_PATH
+
+      - name: Install dependencies
+        run: pixi install
+
+      - name: Build package
+        run: pixi run python -m build
+
+      - name: Publish package to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1