Move PyPI publishing to OIDC trusted publishing (drop static tokens), build the frontend in the release workflow, and tag releases from the CHANGELOG. Acceptance: a tagged GitHub release publishes to PyPI via OIDC with frontend assets built.
Move PyPI publishing to OIDC trusted publishing (drop static tokens), build the frontend in the release workflow, and tag releases from the CHANGELOG.
Acceptance: a tagged GitHub release publishes to PyPI via OIDC with frontend assets built.