ci: run publish job in pypi environment for trusted publishing

PyPI trusted publisher is configured with environment name 'pypi', but
the job did not declare it, so the OIDC token's environment claim was
MISSING and uploads were rejected with invalid-publisher.

Author: abhiksark

.github/workflows/publish.yml

@@ -7,6 +7,7 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    environment: pypi
     permissions:
       contents: read
       id-token: write