ci: make PyPI publish step idempotent on re-runs

Add skip-existing: true to the production PyPI publish step in the
deploy job, matching the existing testpypi job. Without this, if the
SBOM download/upload steps after the publish step fail, a re-run would
be blocked because PyPI rejects re-uploading an already-published version.

https://claude.ai/code/session_01VPK44jamDeLp4Tcy916XDT

Author: claude

.github/workflows/python-publish.yml

@@ -100,6 +100,8 @@ jobs:
         path: dist/
     - name: Publish distribution 📦 to PyPI
       uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1
+      with:
+        skip-existing: true
     - name: Download SBOM
       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v5
       with: