ci: bump pypi-publish to v1.12.4 (twine 6.1.0) for Metadata-Version 2.4

The publish step failed `twine check` with "Metadata is missing required
fields: Name, Version … supported Metadata-Version: …2.3". Current setuptools
(via `uv build`) emits Metadata-Version 2.4; gh-action-pypi-publish v1.12.2
bundles twine 5.1.1, which only parses up to 2.3.

Verified locally against the actual 0.1.0 wheel + sdist:
  - twine 5.1.1  -> reproduces the exact error
  - twine 6.1.0  -> both PASS

v1.12.4 pins twine==6.1.0. Pinned to its commit sha
76f52bc884231f62b9a034ebfe128415bbaabdfc (not the annotated tag-object sha);
ghcr image for that commit verified present (HTTP 200).

Author: anassg-lago

.github/workflows/publish.yml

@@ -122,11 +122,16 @@ jobs:
           name: dist
           path: dist/
       - name: Publish
-        # Pinned to the COMMIT sha (not the annotated-tag object sha). This is a
-        # Docker action; GitHub pulls ghcr.io/pypa/gh-action-pypi-publish:<ref>,
-        # and pypa publishes that image tagged by commit sha — the tag-object sha
-        # has no image (manifest unknown).
-        uses: pypa/gh-action-pypi-publish@15c56dba361d8335944d31a2ecd17d700fc7bcbc # v1.12.2
+        # v1.12.4 bundles twine 6.1.0, which understands Metadata-Version 2.4
+        # (what current setuptools / `uv build` emit). v1.12.2 shipped twine
+        # 5.1.1, which rejects 2.4 with "Metadata is missing required fields:
+        # Name, Version".
+        #
+        # Pinned to the COMMIT sha (not the annotated-tag object sha): this is a
+        # Docker action and GitHub pulls ghcr.io/pypa/gh-action-pypi-publish:<ref>;
+        # pypa publishes that image keyed by commit sha, so the tag-object sha has
+        # no image (manifest unknown).
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
         # No `password:` — OIDC handles auth automatically.
 
   # ----------------------------------------------------------------------