When we're ready to drop the twine<6 + setuptools<77 pins on the
build runner, this doc is the recipe. Covers:
- PyPI side: registering a pending publisher per project
- GitLab side: id_tokens: PYPI_ID_TOKEN: aud: pypi
- What pins to drop after migration
- Why coordinated across all four python/* repos in one go
Today we ship via classic ~/.pypirc on the build runner. Trusted
Publishing replaces that with short-lived OIDC tokens minted per
pipeline. Per-project scope, per-pipeline expiry, no long-lived
secret on the runner.
