Make the PyPI publish job opt-in

[degoldschmidt]

Makes the PyPI publish job opt-in, so tagging v0.2.0 produces a green release run
instead of a red one.

Why

flypad is not on PyPI and no trusted publisher is configured for this repository. As the
workflow stood, every tag would build the distributions, smoke-test the wheel — both fine —
and then fail on a publish step that could never have succeeded. A release run that is
always red is worse than no signal at all: it trains you to ignore the one workflow whose
failures matter most.

Worth noting the job could not have worked even with a publisher configured until the
previous PR: uv build was producing a 124 MB sdist, over PyPI's 100 MB per-file limit.
That is fixed on main; this PR handles the remaining half.

What changes

One condition on the publish job:

if: vars.PYPI_PUBLISH == 'true'

Unset, the job is skipped — grey, which is the honest signal for "not enabled", as
opposed to red for "broken". build and smoke still run on every tag, so the release is
still verified end-to-end; only the upload is withheld.

Enabling PyPI later needs no workflow edit:

1. register a trusted publisher on PyPI for this repository (workflow release.yml,
   environment pypi);
2. create the pypi environment under Settings → Environments;
3. set the repository variable PYPI_PUBLISH to true under
   Settings → Secrets and variables → Actions → Variables.

Those steps are recorded in the job's comment so they are there when they are wanted,
along with the reminder that publishing is irreversible — a version, once accepted by PyPI,
cannot be reused.

Verification

gh variable list reports no repository variables, so the gate currently evaluates false
and the job will skip. Tagging v0.2.0 after this merges should give build ✅, smoke ✅,
publish ⏭️.

Nothing else in the workflow changes, and release.yml only triggers on v* tags, so this
cannot affect ci or docs.

Order

This needs to be on main before the v0.2.0 tag is created — a tag created first
would still carry the ungated job and fail red on the run.