[codex] Add TestPyPI trusted publishing readiness

[stacknil]

Summary

This PR adds the v0.5 PR4 TestPyPI / Trusted Publishing readiness dry-run path for tools/sbom-diff-and-risk.

It intentionally stops short of production PyPI publishing. The new workflow always performs the no-risk validation path: build the wheel and source distribution, run twine check, and upload the checked distributions as a GitHub Actions artifact. A TestPyPI upload job exists, but it only runs from workflow_dispatch when a maintainer explicitly sets publish_to_testpypi=true, and it requires the external TestPyPI pending/trusted publisher configuration to match first.

Authentication and publishing model

The TestPyPI upload job uses OIDC / Trusted Publishing through pypa/gh-action-pypi-publish@release/v1 and repository-url: https://test.pypi.org/legacy/. It does not use or document a long-lived PyPI API token.

The workflow identity documented for TestPyPI is:

• owner: stacknil
• repository: scientific-computing-toolkit
• workflow: sbom-diff-and-risk-testpypi.yml
• environment: testpypi
• project: sbom-diff-and-risk

Both PyPI and TestPyPI project JSON endpoints currently return 404 for sbom-diff-and-risk, so this PR documents that the correct current outcome is Trusted Publishing readiness only unless maintainers complete the external TestPyPI pending publisher setup and run the manual upload after merge.

Scope boundaries

This PR does not change CLI analysis behavior, SARIF behavior, policy behavior, release asset publishing, or production PyPI publishing. It preserves the existing GitHub artifact/release provenance docs and only adds the TestPyPI readiness path plus publishing-readiness documentation.

Validation

Local validation performed:

cd tools/sbom-diff-and-risk
python -m build
$files = (Get-ChildItem dist -File).FullName
python -m twine check $files
python -m pytest

Results:

• python -m build: passed
• python -m twine check: passed for wheel and sdist
• python -m pytest: 145 passed
• git diff --check: passed

Post-merge validation

Run the new sbom-diff-and-risk-testpypi workflow manually with publish_to_testpypi=false to validate the safe no-upload path. After TestPyPI has the matching pending publisher and the testpypi GitHub environment exists, run it again with publish_to_testpypi=true to complete the TestPyPI dry-run.

[stacknil]

Self-review note: PR4 scope is limited to TestPyPI / Trusted Publishing readiness. The workflow is manually gated, uses OIDC-compatible permissions, separates build/check from upload, and keeps production PyPI publishing absent. Verified locally with build, twine check, pytest, and git diff --check; GitHub checks are green and the TestPyPI publish job is skipped by default.