fix(ci): switch to legacy PyPI token for publish workflow

PyPI Trusted Publishing (OIDC) is misconfigured for this repository.
Use legacy API token stored in PYPI_API_TOKEN secret instead.

The pypi/gh-action-pypi-publish action requires a user + password when
OIDC is not available. The PYPI_API_TOKEN secret must contain a valid
legacy PyPI upload token with access to the hawk-sdk project.

Author: Patel230

.github/workflows/release.yml

@@ -2,8 +2,10 @@
 # Triggered by release-please when it pushes a v* tag.
 # Source of truth: https://github.com/GrayCodeAI/hawk/blob/main/.shared-templates/workflows/python-release.yml.tmpl
 #
-# Uses PyPI Trusted Publishing (OIDC) — no API tokens stored in GitHub.
-# Configure once at https://pypi.org/manage/account/publishing/
+# Uses PyPI legacy API token — OIDC trusted publishing requires manual PyPI config
+# that is currently broken for this repository.
+# To fix: remove any OIDC/trusted publisher config at https://pypi.org/manage/account/publishing/
+# Then configure once with: https://github.com/GrayCodeAI/hawk/blob/main/.shared-templates/workflows/python-release.yml.tmpl
 
 name: release
 
@@ -13,14 +15,10 @@ on:
 
 permissions:
   contents: read
-  id-token: write   # required for PyPI Trusted Publishing
 
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest
-    environment:
-      name: pypi
-      url: https://pypi.org/p/hawk-sdk
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -38,4 +36,6 @@ jobs:
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
+          user: __token__
+          password: ${{ secrets.PYPI_API_TOKEN }}
           packages-dir: dist/