ci: publish to PyPI with trusted publishing

[nandgator]

What

Replaces the disabled package.yaml.bkp with a working package.yaml that builds and publishes to PyPI.

• Builds with package/export pkg, so the man page is generated and shipped in the sdist (docs/validators.1), like package/roll.sh.
• Sets SOURCE_DATE_EPOCH from the commit time, so the wheel is reproducible.
• Publishes with PyPI trusted publishing (OIDC): no API token stored in the repo. The old file passed a PYPI_API_TOKEN secret and uploaded a Pages artifact, which could not have worked.
• Runs on a published release or a manual run; skipped on forks.
• Build and publish are separate jobs; only publish gets id-token: write, under a pypi environment.

Needed before first use (maintainer)

1. On PyPI, project validators -> Publishing -> add a trusted publisher: owner python-validators, repository validators, workflow package.yaml, environment pypi.
2. In this repo, create an environment named pypi (optionally with required reviewers as a manual gate).

Testing

• actionlint is clean for all workflows.
• The build steps were run locally on the 0.36.0 tag: the wheel is byte-identical across runs (sha256 04f45891...cd66) and the sdist contains the man page.
• The publish job itself can only run in CI.

🤖 Generated with Claude Code