CI: add PyPI Trusted-Publishing “publish” job to wheels workflow (#61669)

[evgmosme]

• closes ENH: Switch to trusted publishing for package upload to PyPI in CI #61669
• all code checks passed (pre-commit & CI)
• added an entry in doc/source/whatsnew/v3.0.0.rst

Summary

This PR enables Trusted Publishing (OIDC) uploads to PyPI when a GitHub release is published.

What’s changed

• .github/workflows/wheels.yml

  • adds a new publish job that
    1. downloads all wheel / sdist artifacts from upstream jobs;
    2. excludes Pyodide wheels (*pyodide*.whl);
    3. runs pypa/gh-action-pypi-publish@v1 in the pypi environment.

• doc/source/whatsnew/v3.0.0.rst

  • adds a single Build / CI line announcing the switch to Trusted Publishing

• doc/source/development/maintaining.rst

  • drop manual twine step and note Trusted Publishing

No other files or CI matrix settings were changed.

[evgmosme]

CI failed in the docstring-validation step with

AttributeError: 'getset_descriptor' object has no attribute '__module__'. Did you mean: '__reduce__'?

This occurs before my code runs, so it isn’t caused by the changes in this PR.
It looks related to the latest numpydoc release.
I’ll re-run CI once the upstream fix lands.

[EpicWink]

This workflow runs every day, on all pushes, and on all pull requests, but you said "uploads to PyPI when a release tag is pushed" in the description. Perhaps you want to put this in a new publish.yml workflow file, with on: { release: { types: [published] } }.

Because this makes the download-artifacts step run in a different workflow, you'll need to figure out the run-id argument.

You could alternatively add on: { release: { types: [published] } } to the wheels.yml workflow.

---

You need to update the release process documentation to change the new method for publishing (remove step 5: "Upload wheels to PyPI").

---

You likely want to document (in this pull request's description, and in the release process documentation) the new pypi GitHub environment needs to exist, and the corresponding publisher needs to be added to the project in PyPI.

[evgmosme]

@EpicWink All requested changes are in. Let me know if anything else’s needed - thanks!