ci: PyPI trusted publisher for sdk-python #9

Sub-issue of #8. This needs an owner of the openshell project on PyPI.

Why

PyPI trusts only core's release workflow to publish openshell today. #8 publishes from sdk-python's release.yml through trusted publishing (OIDC), so PyPI needs a second trusted publisher for this repository. No API token is created or stored anywhere.

Steps

1. Add the trusted publisher on PyPI

Go to pypi.org → openshell → Settings → Publishing → Add a new publisher → GitHub.

• Workflow name: the file name only, not the path. PyPI matches the workflow file that contains the publishing job. In ci: tag lockstep releases and publish to PyPI with trusted publishing #8 that is release.yml itself. For comparison, core's publisher names its reusable wheel-publish.yml, with environment pypi.
• Environment name: set it. Then only jobs in the pypi environment (ci: pypi and testpypi environments #10), which only main can deploy to, can publish.

Don't remove core's existing publisher. Core may still publish one more wheel (decision 1 in #8). It is removed in NVIDIA/OpenShell#5287, phase 5.

2. Add the trusted publisher on TestPyPI

TestPyPI has an openshell project too (only 0.0.0.dev0). Its owners are separate from PyPI's.

• If you're an owner: add the same publisher at test.pypi.org → openshell → Settings → Publishing, but with environment testpypi.
• If you aren't: note the owner here. The TestPyPI dry run in ci: tag lockstep releases and publish to PyPI with trusted publishing #8 can then use a pending publisher under another name, or be skipped.

3. Check the project's people

Under Collaborators on the PyPI project, check who can manage it once publishing moves here. Consider adding an SDK maintainer as a second owner, so the project doesn't depend on one account. Every owner needs 2FA.

Done when

• pypi.org lists the publisher ai-openshell/sdk-python, release.yml, environment pypi. Core's publisher is unchanged.
• test.pypi.org lists the same publisher with environment testpypi, or this issue says why not.