Move away from PyPI token usage

[nikhilwoodruff]

          __comment:__ Maybe out of scope, but noting here that this form of token passage is insecure, as documented in https://github.com/PolicyEngine/issues/issues/199.

Guide to securely publishing from GH Actions at https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/

Originally posted by @anth-volk in #105 (comment)

[vahid-ahmadi]

This has been addressed. The PyPI publishing step was removed entirely (commit dc7c7f4). No secrets.PYPI reference remains in any workflow. GCP authentication uses OIDC via google-github-actions/auth@v2.