fix release: use twine directly instead of gh-action-pypi-publish (avoids OIDC)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: ratal

.github/workflows/release-linux.yml

@@ -39,7 +39,10 @@ jobs:
           pattern: wheel-linux-*
           merge-multiple: true
           path: dist/
-      - uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_TOKEN }}
-          skip-existing: true
+      - name: Publish to PyPI
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
+        run: |
+          pip install twine
+          twine upload dist/* --skip-existing

.github/workflows/release-macos.yml

@@ -29,7 +29,10 @@ jobs:
         with:
           name: wheel-macos
           path: dist/
-      - uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_TOKEN }}
-          skip-existing: true
+      - name: Publish to PyPI
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
+        run: |
+          pip install twine
+          twine upload dist/* --skip-existing

.github/workflows/release-windows.yml

@@ -28,7 +28,10 @@ jobs:
         with:
           name: wheel-windows
           path: dist/
-      - uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_TOKEN }}
-          skip-existing: true
+      - name: Publish to PyPI
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
+        run: |
+          pip install twine
+          twine upload dist/* --skip-existing