ci: publish holosoma-inference to PyPI (1/3)

[clayrosenthal]

Stacked PR 1 of 3 — publish the holosoma packages to PyPI.

Adds the shared reusable build workflow + the first per-package publisher.

• .github/workflows/_build-python-dist.yml — reusable (workflow_call) build: python -m build (sdist + py3-none-any wheel) → twine check → upload dist artifact. Driven by the runner's own python3 in a venv (no actions/setup-python, same as the SDK release.yml).
• .github/workflows/publish-holosoma-inference.yml — triggers on tag holosoma-inference-v* (or manual dispatch = build-only). Publishes via OIDC Trusted Publishing (environment: pypi, id-token: write, no stored tokens).

Stack (merge bottom-up):

1. ← this PR (base: main; original base PR switching to using pypi sdks #139 already merged)
2. clayros/publish-holosoma-retargeting (ci: publish holosoma-retargeting to PyPI (2/3) #140)
3. clayros/publish-holosoma (ci: publish holosoma (core) to PyPI (3/3) #141)

PyPI setup required (owner does this side): register a Trusted Publisher on the holosoma-inference PyPI project → repo amazon-far/holosoma, workflow publish-holosoma-inference.yml, environment pypi.

[kingb]

Approving. Verified: GHA SHA pins resolve correctly (checkout v6.0.2, upload-artifact v7, download-artifact v8), PyPI project names match the per-package workflows, and the tag globs don't collide. Reusable build + OIDC trusted-publishing pattern is sound. One non-blocking follow-up raised separately: confirm the runner's preinstalled uv supports --trusted-publishing always before the first release tag.