Security: Finish PyPI Trusted Publisher binding (OIDC)

[caidurbin]

What to build

Complete the tokenless PyPI publishing lane. The workflow already publishes via OIDC Trusted Publishing with PEP 740 attestations on by default; what's missing is the PyPI-side binding (project + repo + workflow + environment). Verify current state first — this may have been partially completed under closed #24/#30 — then finish or confirm the binding so v*-tag releases publish with no stored API token.

Acceptance criteria

• Confirm whether the Trusted Publisher binding already exists (check closed PyPI account + GitHub Actions secrets configuration #24/Release blustream v0.2.0 to PyPI #30 and PyPI project settings)
• PyPI Trusted Publisher bound to the repo + release-pypi.yml + the pypi environment
• A release publishes via OIDC with no stored API token; PEP 740 attestations appear on the published files

Blocked by

• Security: Environment protection on the release jobs (PyPI / HACS / c4z) #44 — Security: Environment protection on the release jobs (the pypi environment must exist to bind the Trusted Publisher to)