fix(ci): inline the PyPI publish step instead of a composite action

pypa/gh-action-pypi-publish is a Docker container action. Nested inside
reqstool/.github's actions/publish-to-pypi composite action, GitHub
resolved its image using the composite action's own repo and pinned
ref instead of the Docker action's, and every real publish failed with
`docker: invalid reference format`. The action's own maintainers say
this usage is untested and unsupported.

Both steps -- download-artifact and the actual publish -- are now
inline, matching the pattern the upstream workaround comment already
showed (see reqstool/.github#95 for the full writeup). There is no
shared action for this step in the org at all now; what remained after
removing the publish call wasn't enough to justify one.

Needs reqstool/.github#94 merged first.

Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>

Author: jimisola

.github/workflows/release.yml

@@ -109,9 +109,13 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: reqstool/.github/.github/actions/publish-to-pypi@b10b898cd5a1d552a578dbe4f170f84fb8f98b6c # main 2026-08-23
+      - uses: actions/download-artifact@v8.0.1
         with:
-          artifact: dist-tagged
+          name: dist-tagged
+          path: dist
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          attestations: true
 
   # Last, deliberately. Everything above can fail, and until this runs nothing
   # resolving "the latest release" can see what was built -- the release is still