Use trusted publishing

[madig]

In light of the recent npm supply chain attacks and also https://blog.pypi.org/posts/2025-09-16-github-actions-token-exfiltration/, I'm combing through our font stack to see if all them Py projects are using the trusted publisher mechanism as recommended by PyPI. See https://docs.pypi.org/trusted-publishers/ and https://docs.astral.sh/uv/guides/integration/github/#publishing-to-pypi.

Someone needs to do three things for this PR to work:

• Create an environment called "publish-to-pypi" in this GitHub repository under Settings -> Environments. Creating alone is probably enough, no configuration needed I think.
• Follow https://docs.pypi.org/trusted-publishers/adding-a-publisher/ to set up the other side on PyPI.
• Remove tokens/secret variables here so they can't be exfiltrated anymore, and probably also remove them from PyPI.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.46%. Comparing base (488f79a) to head (eec58fd).
⚠️ Report is 22 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #477   +/-   ##
=======================================
  Coverage   87.46%   87.46%           
=======================================
  Files          57       57           
  Lines       10352    10352           
  Branches     1244     1244           
=======================================
  Hits         9054     9054           
  Misses        921      921           
  Partials      377      377           

Flag	Coverage Δ
unittests	87.46% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[benkiel]

Done