📦 Move PyPI release workflow into the main workflow.

This ensures that any releases are fully tested before publication.

The workflow first builds the distribution files (sdist, wheel) before
using a deployment environment to publish these to PyPI, using the
GitHub actions OpenID support to authenticate with PyPI.

tox.ini

@@ -43,3 +43,11 @@ commands_pre =
     poetry install --no-root --sync --with=linting
 commands =
     ruff check --fix .
+
+[testenv:lint_distributions]
+description = Lint distribution files with Twine
+skip_install = true
+commands_pre =
+    poetry install --no-root --sync --only=distributing
+commands =
+    twine check dist/*