CI: add PyPI Trusted-Publishing “publish” job to wheels workflow (#61669)

[evgmosme]

• closes ENH: Switch to trusted publishing for package upload to PyPI in CI #61669
• tests added / passed
• all code checks passed (pre-commit & CI)
• added an entry in doc/source/whatsnew/v3.0.0.rst

Summary

This PR enables Trusted Publishing (OIDC) uploads to PyPI when a release tag is pushed.

What’s changed

• .github/workflows/wheels.yml

  • adds a new publish job that
    1. downloads all wheel / sdist artifacts from upstream jobs;
    2. excludes Pyodide wheels (*pyodide*.whl);
    3. runs pypa/gh-action-pypi-publish@v1 in the pypi environment.

• doc/source/whatsnew/v3.0.0.rst

  • adds a single Build / CI line announcing the switch to Trusted Publishing

No other files or CI matrix settings were changed.

[evgmosme]

CI failed in the docstring-validation step with

AttributeError: 'getset_descriptor' object has no attribute '__module__'. Did you mean: '__reduce__'?

This occurs before my code runs, so it isn’t caused by the changes in this PR.
It looks related to the latest numpydoc release.
I’ll re-run CI once the upstream fix lands.