Publish via GitHub OIDC role

[deorus]

The CI role from Doist/platform-backlog#1569 is now provisioned (Doist/infra#774, github-roles-FractionalIndexingPython-73esVaEfRRD9), following the dateist-python OIDC pattern instead of the billist secret-based one:

• release.yml assumes the role and fetches the CodeArtifact token at publish time
• update-aws-codeartifact-token.yml is gone — no AWS_CODEARTIFACT_TOKEN or GH_REPO_TOKEN secrets needed

[doistbot]

This PR migrates the publish workflow from a secret-based CodeArtifact token to GitHub OIDC role assumption, removing the token-rotation workflow and fetching the token at publish time.

Few things worth tightening:

• Pin aws-actions/configure-aws-credentials to a full commit SHA rather than the mutable v6 tag — it runs with both GitHub contents: write and AWS OIDC permissions, so a moved or compromised tag could execute arbitrary code in the release job. The other release-mutating actions in this workflow are already pinned to SHAs, so this would match that pattern.

I also left one optional follow-up note in the details below.

Optional follow-up note (1)

• .github/workflows/release.yml:69: The CodeArtifact auth token captured here is not registered for log masking. The old update-aws-codeartifact-token.yml explicitly called ::add-mask::$token after fetching it; this workflow relies on the value never being echoed. uv publish errors can include the request URL/Authorization, which would surface the token in plain text in the workflow logs (visible to anyone with read access on the repo for the token's ~12h lifetime). Add echo "::add-mask::$UV_PUBLISH_PASSWORD" before uv publish to restore the masking.

_{Share Feedback • Review Logs}

[doistbot]

Pin this action to a full commit SHA rather than the mutable v6 tag. If that tag is moved or its publisher is compromised, arbitrary action code runs in this release job and can mint the AWS OIDC credentials and use the existing contents: write token. Use the commit SHA for the intended v6 release (as this workflow already does for its other release-mutating actions).

[lukemerrett]

Great stuff thank you @deorus