ci: switch PyPI publish to OIDC and fix release tagging

- Drop PYPI_API_TOKEN; rely on Trusted Publisher (id-token + pypi env
  already configured).
- Read version from pyproject.toml and skip publish if the version is
  already on PyPI (avoids failing runs on every push to main).
- Tag the release commit as v<version> and create the GitHub release
  with that tag and auto-generated notes (previously used
  github.ref_name which resolves to "main" under workflow_run).
- Bump runner Python to 3.11 so tomllib is available.

ci: update Python setup and artifact actions in workflows

ci: adjust publish workflow trigger and conditions

- Updated trigger from 
elease and workflow_dispatch to push.
- Removed conditional check for tag refs in the pypi-publish job.

ci: adjust publish workflow trigger and conditions

- Updated trigger from 
elease and workflow_dispatch to push.
- Removed conditional check for tag refs in the pypi-publish job.