feat: add publish workflow for PyPI Trusted Publishing via git tag

[tehw0lf]

Summary

• Adds .github/workflows/publish.yml triggered on v* tag push
• Downloads the build artifact and publishes to PyPI via OIDC Trusted Publishing
• Depends on tehw0lf/workflows PR #46 being merged first (reusable workflow now sets the git tag instead of publishing directly)
• Do not merge until PyPI Trusted Publishing is configured for this repo and workflows PR #46 is merged

Test plan

• Merge refactor: replace PyPI publish with git tag, use GITHUB_OUTPUT in release-github workflows#46
• Configure PyPI Trusted Publishing: publisher = tehw0lf/wlgen, workflow = publish.yml
• Merge this PR and verify the tag-triggered publish runs successfully