ci: use pypi trusted publishing in release state

.github/workflows/release-runner.yml

@@ -19,6 +19,7 @@ jobs:
   release-state:
     if: github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'release:')
     runs-on: ubuntu-latest
+    environment: pypi
     steps:
       - uses: actions/checkout@v4
         with:

bin/release.sh

@@ -409,7 +409,7 @@ publish_artifacts() {
         if [[ -n "${pypi_token}" ]]; then
             UV_PUBLISH_TOKEN="${pypi_token}" uv publish --username=__token__ "${artifacts[@]}"
         else
-            uv publish --username=__token__ "${artifacts[@]}"
+            uv publish --trusted-publishing always "${artifacts[@]}"
         fi
     fi