feat: migrate to OIDC trusted publishing

[visubique]

Same migration as ossprey-python-client: stops inlining release logic, switches to OIDC, collapses the separate test-release workflow into a checkbox on the main one.

Changes

• Replace inlined release steps in release.yml with uses: ossprey/cicd/python-release@v2.
• Add a test boolean workflow_dispatch input.
• Add job-level environment: pypi and permissions: id-token: write.
• Remove top-level permissions block.
• Delete test-release.yml — the test checkbox in release.yml replaces it.
• Keep Slack failure notifier.

Required before merge: PR in cicd merged + tagged v2; PyPI/TestPyPI trusted publishers registered for ossbom; GitHub Environment pypi created in repo settings.

[osspreyqa]

SBOM submitted! Check the Ossprey platform: https://dashboard.ossprey.com/asset/?id=ossprey%2Fossbom

[osspreyqa]

Warning! Potential malware in this PR. Please review the vulnerability report.

[webknjaz]

@andyantrim I'm assuming this is what motivated pypa/gh-action-pypi-publish#406?

Tip

TL;DR — always build in a separate job that does not have OIDC privileges.
Only perform upload to PyPI in the job with OIDC. Otherwise, you're letting your build backend (and its transitive dep tree) impersonate you, not just against PyPI but anything else that may gain transitive trust to the repo in the future.

[osspreyqa]

SBOM submitted! Check the Ossprey platform: https://dashboard.ossprey.com/asset/?id=ossprey%2Fossbom

[osspreyqa]

Warning! Potential malware in this PR. Please review the vulnerability report.