ci: use trusted PyPI publishing

[aadithyanr]

Summary

• publish releases through PyPI Trusted Publishing instead of a stored API token
• scope the release job to read-only contents plus GitHub OIDC
• pin the PyPI publish action to an immutable commit
• document the keyless release flow

Validation

• git diff --check
• release workflow follows the official deepset standalone-component template build path
• publisher action pinned to the current release/v1 commit