Specify parameters required for "Publishing with a Trusted Publisher"

See https://docs.pypi.org/trusted-publishers/using-a-publisher/

.github/workflows/pypi-ci.yml

@@ -46,6 +46,11 @@ jobs:
     runs-on: ubuntu-24.04
     needs: [build_wheels]
     if: startsWith(github.ref, 'refs/tags')
+    # Specifying a GitHub environment is optional, but strongly encouraged
+    environment: release
+    permissions:
+      # IMPORTANT: this permission is mandatory for trusted publishing
+      id-token: write
     steps:
       - name: Download artifacts
         uses: actions/download-artifact@v4
@@ -55,5 +60,3 @@ jobs:
 
       - name: Publish distribution 📦 to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}