Restore PyPI trusted publisher environment for verified publishing

Adds back the environment block with OIDC permissions so PyPI
marks the package as published by a verified source.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: aksOps

.github/workflows/publish.yml

@@ -138,6 +138,12 @@ jobs:
     needs: [test-os, test-container]
     runs-on: ubuntu-latest
     if: inputs.dry_run == false
+    environment:
+      name: pypi
+      url: https://pypi.org/p/osscodeiq
+    permissions:
+      id-token: write
+      attestations: write
     steps:
       - name: Download artifacts
         uses: actions/download-artifact@v4