Deploy cladetime to test-pypi

[bsweger]

Background

This PR is a starting point for getting Cladetime to PyPI.. It adds a new workflow based on part of the instructions here:
https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/

• Builds the distribution package
• Publishes it to test-pypi

Out of scope for the PR:

• Signing the package and uploading to GitHub releases
• Tagging stuff
• Publishing to PyPI proper

Implementation

• one time step: create a Cladetime trusted publisher on test-pypi (done)

• add a GitHub workflow to build and publish the package:
  • uv does the build (not strictly necessary, since we're using the setuptools build backend, but laying groundwork for more future uv things)
  • The Python Packaging Authority's (PyPA) gh-action-pypi-publish action publishes to test-pypi. This action supports PyPi's trusted publisher feature (aka PyPi's OIDC provider)

Reviewing and testing

• Are there any changes needed to the package metadata as it's displayed on test-pypi: https://test.pypi.org/project/cladetime/?

Because this is a new workflow, we'll like need to merge the PR before trying the following:

• Can we run the new publish-pypi-test.yaml workflow successfully?
• Manual approval should be required before the publish-to-pypi-test job executes

[bsweger]

pypi-test is an environment I created in the cladetime repo: https://github.com/reichlab/cladetime/settings/environments

• the environment is specified as part of the trusted publisher I set up on PyPI (see screenshot on PR description)
• the environment also specifies that the jobs using it must be manually approved before they're run (this is a requirement for publishing to PyPI)

[zkamvar]

This looks cromulent to me. A lot of this is new to me, but it's really nice to see an actual use-case for GitHub environments and the usage of the id-token permission.