Add publish environment and remove unnecessary workflow

[PaulAsjes]

Note

Low Risk
Low risk workflow-only change; main impact is gating tag-based PyPI publishing behind the pypi-publish GitHub Environment, which could block releases if not configured.

Overview
CI release hardening and cleanup. The tag-triggered publish job in ci.yml now runs under the pypi-publish GitHub Environment (while keeping OIDC id-token permissions), enabling environment-scoped protections/secrets for PyPI releases.

Removes the redundant .github/workflows/tests.yml workflow, consolidating compile/test execution under the existing ci.yml pipeline.

^{Reviewed by Cursor Bugbot for commit 5876b12. Bugbot is set up for automated code reviews on this repo. Configure here.}