fix(ci): stop publishing to PyPI through a reusable workflow

PyPI does not accept a reusable workflow as a trusted publisher --
pypi/warehouse#11096, unresolved. Both publish jobs here called
reqstool/.github's python-publish-to-pypi.yml via workflow_call, so
every real publish attempt failed at the OIDC exchange with
invalid-publisher regardless of what the trusted publisher config
named -- confirmed today, and it explains why publish-dev-to-testpypi.yml
has been failing on every push to main since the 2026-08-16 migration.

Switches both jobs to reqstool/.github's new actions/publish-to-pypi
composite action, called directly from a job defined in this workflow.
A composite action doesn't have the same problem: the OIDC claim is
about which workflow file the job runs in, not what its steps reference.

The two-index environment derivation (testpypi -> test, pypi -> stable)
that the reusable workflow computed internally now has to be explicit
per job -- a composite action can't set the caller's environment:.

Needs reqstool/.github#92 merged first.

Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>

Author: jimisola

.github/workflows/publish-dev-to-testpypi.yml

@@ -22,8 +22,13 @@ jobs:
 
   publish-to-test-pypi:
     needs: build
-    uses: reqstool/.github/.github/workflows/python-publish-to-pypi.yml@main
+    runs-on: ubuntu-latest
+    environment:
+      name: test
+      url: https://test.pypi.org
     permissions:
       id-token: write
-    with:
-      target: testpypi
+    steps:
+      - uses: reqstool/.github/.github/actions/publish-to-pypi@main
+        with:
+          target: testpypi

.github/workflows/release.yml

@@ -97,25 +97,35 @@ jobs:
 
   publish-to-testpypi:
     needs: [prepare, assets]
-    uses: reqstool/.github/.github/workflows/python-publish-to-pypi.yml@main
+    runs-on: ubuntu-latest
+    environment:
+      name: test
+      url: https://test.pypi.org
     permissions:
       id-token: write
-    with:
-      target: testpypi
-      artifact: dist-tagged
+    steps:
+      - uses: reqstool/.github/.github/actions/publish-to-pypi@main
+        with:
+          target: testpypi
+          artifact: dist-tagged
 
   # PyPI is the only step here that cannot be undone: a version can be yanked but
   # never replaced. A release candidate stops at Test PyPI -- pip needs --pre to
   # see a prerelease anyway.
   publish-to-pypi:
     needs: [prepare, publish-to-testpypi]
     if: ${{ needs.prepare.outputs.prerelease != 'true' }}
-    uses: reqstool/.github/.github/workflows/python-publish-to-pypi.yml@main
+    runs-on: ubuntu-latest
+    environment:
+      name: stable
+      url: https://pypi.org
     permissions:
       id-token: write
-    with:
-      target: pypi
-      artifact: dist-tagged
+    steps:
+      - uses: reqstool/.github/.github/actions/publish-to-pypi@main
+        with:
+          target: pypi
+          artifact: dist-tagged
 
   # Last, deliberately. Everything above can fail, and until this runs nothing
   # resolving "the latest release" can see what was built -- the release is still