ci: verify production PyPI authentication without uploading

[ernestprovo23]

What & why

The 1.2.0 and 2.0.0 release runs failed PyPI OIDC exchange with invalid-publisher, although the repo gate was enabled. Version 2.0.0 was recovered by uploading the exact signed artifacts with the existing authorized credential. The docs incorrectly claimed the Trusted Publisher was configured and offered only a package-upload path for authentication checks.

Add an authentication-only verify-pypi choice in the existing release.yml. It skips building, uploading and signing, requests the same workflow identity, and exchanges a short-lived GitHub OIDC token with production PyPI. Before any token request, the workflow/script require reviewed main and an explicit owning-account publisher inspection acknowledgment. The script validates the fixed repository/owner/workflow/no-environment contract, bounds HTTPS/JSON reads, refuses redirects, and never logs/stores tokens or uncontrolled server descriptions. A successful exchange is explicitly separate from project upload authorization. PyPI minting can mutate pending publisher records; docs require checking the normal publisher and matching pending entries visible in the owning account, and explicitly disclose that this cannot exclude other users’ records.

Release/TestPyPI upload authentication stays OIDC-only. Existing permissions, pinned actions, publisher identities and reviewer gates are preserved. No token fallback, credential change, package version bump or release-asset replacement is introduced.

Correct the runbook and three core docs: existing-project publisher URL/fields, pending publishers do not reserve names, authentication precedes duplicate handling, and the failed-job-only recovery path retains original artifacts.

Validation

• 141 focused probe/workflow-pin tests pass, including identity mismatches, hostile request URLs, redirects, malformed responses, expiry and secret-reflection failures.
• Ruff, strict MkDocs, diff check, local links and the three-core-doc 500-line gate pass.
• Independent CSO APPROVE at 8f4b9ad1be9c64860af1564f4639418071426cdb; 23 negative preflight combinations make zero network calls.
• Local rendered runbook passes desktop 1440px and mobile 390px with no horizontal overflow; GitHub browser preview returned HTTP 503 twice, so the circuit was opened. All GitHub CI checks pass at the reviewed head.

Remaining external configuration

The actual PyPI publisher settings require a logged-in project-owner browser session; the builder is redirected to login. Ernest has been asked for the current Owner/Repository/Workflow/Environment fields. This PR does not claim that the server-side mismatch is repaired. Production exchange/unchanged-artifact rerun will be verified after alignment.

Owner authorized fixing this automation and session wrap-up in authenticated chat on 2026-10-02. See the scoped implementation plan for evidence and the remaining boundary.