ci: use OIDC trusted publishing and SHA-pin pypi-publish in release.yml

[farhan]

Important

PR implemented with the assistance of Claude Code. Refined and validated before being submitted for code review.

Modernize release.yml
Part of openedx/public-engineering#506

Summary

• Switch PyPI publishing to OIDC trusted publishing — remove the user: __token__ / password: ${{ secrets.PYPI_UPLOAD_TOKEN }} inputs.
• SHA-pin pypa/gh-action-pypi-publish to dc37677b2e1c63e2034f94d8a5b11f265b73ba33 (v1.14.2) instead of the floating @release/v1 ref.

Why

• A floating ref on pypa/gh-action-pypi-publish previously caused a production incident, so SHA-pinning this action is required.
• OIDC trusted publishing removes the need for a long-lived PyPI token stored as a repo secret.

Important Notes

• A PyPI trusted publisher (OIDC) must be configured for this project before this PR is merged, otherwise the publish step will fail. Configure it in the project's PyPI settings pointing at this repo, release.yml, and the publish_to_pypi job.
• Once merged, PYPI_UPLOAD_TOKEN is no longer used and can be removed from repo secrets.

Testing Notes

Validated with actionlint and a YAML parse. Not exercised end-to-end (release runs only on push to main). Repo-owner should confirm the trusted publisher is configured before merge.

---

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.17%. Comparing base (0e85d6a) to head (95c3b0f).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #64   +/-   ##
=======================================
  Coverage   82.17%   82.17%           
=======================================
  Files          48       48           
  Lines        1419     1419           
  Branches      110      110           
=======================================
  Hits         1166     1166           
  Misses        221      221           
  Partials       32       32           

Flag	Coverage Δ
unittests	82.17% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.