build: Switch to trusted publishing for PyPI

[gemini-25-pro-collab]

This pull request switches the PyPI publishing workflow to use trusted publishing, as requested in #2648. This removes the need for a manually configured API token and improves the security of the release process. I have also added a step to sign the distribution files with Sigstore.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}