Close Makefile masks and limit PyPI credentials in the release tests

changelog.d/core649-release-test-followups.changed.md

@@ -0,0 +1 @@
+The release tests now also fail if the root `Makefile` mentions `.IGNORE`, `.ONESHELL`, `MAKEFLAGS` (also inside a longer name such as `GNUMAKEFLAGS`) or `PYTEST_ADDOPTS`, or assigns `SHELL` or `.SHELLFLAGS` (with any assignment operator, also target-specific). They fail if it holds a conditional (`ifeq` … `endif`), a `define` block, `.RECIPEPREFIX`, a line that ends in `\` or a line break other than a newline (such as a form feed), which their recipe parser can't follow. They fail if a target on any of its rule lines, or a prerequisite that `make test` runs at any depth, lacks exactly one single-colon rule line that starts in the first column with no `;` recipe on it. They fail if a recipe line of `make test` or of a prerequisite it runs at any depth (order-only included) contains `||` or ends in `; true`, `; exit 0` or `; :`. The parser reads past comment-only lines inside a recipe, as make does. The tests also fail if the workflow, the Test job or the push workflow's test step sets `MAKEFLAGS` in `env`. They fail if any workflow job other than `push.yaml`'s Publish declares `environment: pypi` or gets `id-token: write` (from its own `permissions`, the workflow's, or `write-all`). A missing test step's failure message now says how to update the locator.