ci: grant id-token permission for PyPI trusted publishing

[houfu]

Problem

The 0.9.0 publish run failed:

error: Trusted publishing failed
  Caused by: Failed to obtain OIDC token: is the `id-token: write` permission missing?
  Caused by: insufficient permissions: missing ACTIONS_ID_TOKEN_REQUEST_URL
error: Failed to publish ... Missing credentials

The workflow declares permissions: contents: read at the top level, which replaces the default token grants for every job — so the publish job has no id-token permission, GitHub never exposes the OIDC endpoint to the runner, and uv publish (which was correctly attempting Trusted Publishing after UV_PUBLISH_TOKEN was removed) falls through to an unauthenticated upload.

Fix

• Job-level permissions: { contents: read, id-token: write } on the publish job.
• While here: zeeker-common added to the workflow_dispatch package choice and the build step honors the input (release events still default to zeeker), so zeeker-common 0.2.0 can ship from the same workflow.

⚠️ PyPI-side checklist (can't be done from the repo)

Trusted Publishing also requires a matching publisher configuration on pypi.org, or the OIDC token will be minted but rejected:

1. pypi.org → project zeeker → Settings → Publishing → add (or verify) a GitHub publisher with owner zeeker-sg (not houfu — the repo moved orgs; a publisher registered under the old owner will not match), repository cli, workflow publish-zeeker.yml, environment release.
2. Same for the zeeker-common project before dispatching a zeeker-common publish. If zeeker-common doesn't exist on PyPI yet, add it as a pending publisher (PyPI → Your account → Publishing → "Add a pending publisher") so the first upload can create it.
3. The GitHub repo must have an environment named release (Settings → Environments) since the job pins environment: release and the PyPI publisher config references it.

After merging, re-run the failed publish (re-publish the release or workflow_dispatch with package zeeker), then dispatch once more with zeeker-common.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Cuh5eJDfVowgpp22s7siE1

---

Generated by Claude Code