Stop bump.yml from publishing to PyPI to fix trusted-publisher failure

[Copilot]

The Bump version Actions job was failing at publish time with PyPI trusted publishing error invalid-publisher from .github/workflows/bump.yml on main. This change removes publishing from the bump path so release publication remains handled only by the tag-driven release workflow.

• Root cause

  • bump.yml attempted pypa/gh-action-pypi-publish, but the OIDC claims from that workflow/environment do not match a configured PyPI trusted publisher.

• Workflow changes

  • Removed PyPI publish step from .github/workflows/bump.yml.
  • Removed now-unused id-token: write permission.
  • Removed now-unused environment: pypi block from the bump job.

• Resulting release flow

  • bump.yml: version bump + changelog + GitHub release tag creation.
  • release.yml (tag-triggered): package publish to PyPI.

# .github/workflows/bump.yml (after)
permissions:
  contents: write

jobs:
  bump:
    steps:
      # ...
      - name: Build package
        run: uv build --wheel
      - name: Release
        uses: softprops/action-gh-release@v2