ci: add trusted publishing workflow

[mayeut]

No description provided.

[Copilot]

Pull request overview

This PR adds a new trusted publishing workflow for automated PyPI releases and enhances security in the existing test workflow by implementing the principle of least privilege.

• Adds a new release workflow with trusted publishing to PyPI using OIDC authentication and build attestations
• Updates the test workflow to restrict CI runs to the main branch and adds explicit permission scopes
• Implements security hardening by disabling credential persistence in checkout actions and using minimal job-level permissions

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/release.yml	New workflow that builds distribution packages and publishes to PyPI with attestations when releases are published
.github/workflows/test.yml	Security hardening with explicit permissions, credential persistence disabled, and refined trigger to run only on main branch pushes and PRs

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.20%. Comparing base (63fb6cc) to head (09e27e0).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #658   +/-   ##
=======================================
  Coverage   95.20%   95.20%           
=======================================
  Files          22       22           
  Lines        1815     1815           
  Branches      340      340           
=======================================
  Hits         1728     1728           
  Misses         48       48           
  Partials       39       39           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.