ci: merge PyPI publish workflows, switch to trusted publishing

[hewliyang]

Stacked on #113.

What

• Merge publish-shim-pypi.yml into publish-pypi.yml as a second job with needs: publish.
• Switch both jobs to PyPI trusted publishing (OIDC) via uv publish --trusted-publishing always. No token secret.
• Both jobs use environment: pypi and permissions: id-token: write. Top level is contents: read.
• Shim job uses uv build + uvx twine check --strict instead of pip install build twine.
• Remove bin/publish-pypi and its pyproject.toml references (sdist include, ruff ignore).
• Update CONTRIBUTING.

Why one workflow

workflow_run always runs the workflow file from the default branch and checks out the default branch. It also does not fire when the parent is run via workflow_dispatch on a non-default branch. A needs: job runs on the same ref as the release tag and shows up in the same run.

Setup before the next release

1. PyPI reductoai → Manage → Publishing → add GitHub publisher: owner reductoai, repo reducto-python-sdk, workflow publish-pypi.yml, environment pypi.
2. Same for PyPI reducto.
3. Create the pypi environment in GitHub repo settings.
4. After the first successful run, delete REDUCTO_PYPI_TOKEN / PYPI_TOKEN secrets.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}