Add PyPI publish workflow via OIDC Trusted Publisher

[Copilot]

Adds a GitHub Actions workflow to automatically publish hackauth to PyPI on every GitHub Release, using OIDC Trusted Publisher — no API tokens or secrets required.

Workflow (.github/workflows/publish.yml)

• Trigger: release: published
• build job: checks out, builds sdist + wheel via python -m build (hatchling backend), uploads dist/ as artifact
• publish job: downloads artifact, publishes to PyPI via pypa/gh-action-pypi-publish@release/v1 with id-token: write for OIDC; scoped to a pypi GitHub environment
• Top-level permissions: contents: read for least-privilege GITHUB_TOKEN

Required one-time PyPI setup

Log into PyPI and configure a Trusted Publisher at https://pypi.org/manage/account/publishing/:

Field	Value
Project name	hackauth
GitHub owner	wenfeng110402
Repository	Authenticator
Workflow filename	publish.yml
Environment	pypi

Also create a pypi environment in GitHub repo Settings → Environments.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.