CI: remove dead upload_pypi job from reusable workflow, rename to lib-build.yml

[nikagra]

Summary

Closes #824. Follow-up to #820, addressing @Lorak-mmk's review concern.

The upload_pypi job in lib-build-and-push.yml was never reachable: none of the four caller workflows pass upload: true. build-push.yml and publish-manually.yml already publish from their own separate jobs — this is required by how PyPI Trusted Publishing works: the OIDC token embeds the caller workflow path, so the pypa/gh-action-pypi-publish action must run in the caller, not inside a reusable workflow (see pypa/gh-action-pypi-publish#166).

Because the reusable workflow declared permissions: id-token: write for upload_pypi, GitHub's static permission validation (which runs before evaluating any if: conditions) forced build-test.yml — a pull_request workflow, where id-token defaults to none — to also declare id-token: write. This granted unnecessary privileges to a job that only builds wheels.

Changes

Commit 1: remove dead upload_pypi job, rename to lib-build.yml

• Rename lib-build-and-push.yml → lib-build.yml (it only builds now)
• Remove upload input and upload_pypi job from the reusable workflow
• Remove permissions: id-token: write and with: upload: false from build-test.yml — no longer needed, principle of least privilege restored
• Update all callers (build-push.yml, publish-manually.yml, build-pre-release.yml) to reference the new workflow path and drop the now-nonexistent upload: false from with: blocks
• Replace TODO comments in build-push.yml and publish-manually.yml: the separate publish job is now intentional design, not a temporary workaround pending an upstream fix

Commit 2: remove ineffective GITHUB_WORKFLOW_REF override

GITHUB_WORKFLOW_REF was set as a shell env var prefix on the cibuildwheel invocations, introduced in #439 as a workaround for the same issue #166. It does not work for two reasons:

1. GITHUB_WORKFLOW_REF is set by GitHub's runner infrastructure to populate the OIDC token — overriding it in a child process's environment has no effect on the token GitHub's servers mint.
2. The OIDC token is minted when pypa/gh-action-pypi-publish runs (in the publish job), not when cibuildwheel runs (in build-wheels). The variable was being set in the wrong job entirely.

The actual working workaround is already in place: pypa/gh-action-pypi-publish runs directly in the caller workflows (build-push.yml, publish-manually.yml). This variable override was dead code with no effect.

Result

	Before	After
build-test.yml permissions	id-token: write (unnecessary)	none (default, minimal)
lib-build-and-push.yml upload_pypi job	Present but never runs	Removed
Publish responsibility	Dead code in reusable + real publish in callers	Real publish in callers only
GITHUB_WORKFLOW_REF env var	Set in cibuildwheel steps (no effect)	Removed