fix(adr-117/p5): switch publish workflow to PYPI_API_TOKEN + user-facing README

- Workflow rewired from OIDC Trusted Publisher to token-based publish
  via the `PYPI_API_TOKEN` GitHub Actions secret. Both publish jobs
  (v2 wheels + tombstone) pass `password: ${{ secrets.PYPI_API_TOKEN }}`
  to `pypa/gh-action-pypi-publish@release/v1`. Workflow comments now
  document the GCP → GH secret-refresh command.
- Removed `permissions: id-token: write` and the OIDC `environment:`
  blocks (no longer needed without OIDC).
- Token was sourced from the GCP Secret Manager entry `PYPI_TOKEN`
  in project `cognitum-20260110` and pushed to GH Actions via
  `gcloud secrets versions access | gh secret set` so the value
  never appeared in a shell variable or this session's output.
- Rewrote `python/README.md` from a developer phase-ledger into a
  user-facing PyPI front page: one-paragraph elevator pitch, bullet
  list of features, three short usage snippets (vitals extract,
  WS subscribe, MQTT semantic-primitive listener, BFLD numpy
  bridge), hardware table, links. The README is the FIRST thing
  pip users see at https://pypi.org/p/wifi-densepose so it has to
  introduce the project, not the build plan.

Wheel rebuilds clean at 253 KB (was 238 KB — +15 KB from the richer
README baked into the wheel metadata). Test suite unchanged at 183/183.

Refs: docs/adr/ADR-117-pip-wifi-densepose-modernization.md
Refs: #785

Co-Authored-By: claude-flow <ruv@ruv.net>

.github/workflows/pip-release.yml

@@ -13,15 +13,17 @@
 #   1. cut tag `v1.99.0-pip`  → publishes the tombstone wheel first
 #   2. cut tag `v2.0.0-pip`   → publishes the PyO3 v2 wheel matrix
 #
-# Both publish via PyPI Trusted Publisher (OIDC). No API tokens in
-# secrets — see https://docs.pypi.org/trusted-publishers/ for how to
-# register this workflow with PyPI before the first publish.
+# Publishes via PyPI API token stored in the `PYPI_API_TOKEN`
+# GitHub Actions secret. The token value comes from the GCP Secret
+# Manager entry `PYPI_TOKEN` in project `cognitum-20260110`; refresh
+# with:
+#     gcloud secrets versions access latest --secret=PYPI_TOKEN \
+#         --project=cognitum-20260110 \
+#       | gh secret set PYPI_API_TOKEN --repo ruvnet/RuView
 #
-# Q3 (witness hash v2 — open in ADR-117 §11.3) MUST be resolved before
-# the first v2.0.0 publish. The `verify-witness` job below currently
-# only checks the v1 hash for backwards-compatibility against the
-# legacy archive/v1 sample. When v2 lands, add a parallel step that
-# verifies the v2 hash against the Rust pipeline.
+# Q3 (witness hash v2 — open in ADR-117 §11.3) MUST be resolved
+# before the first v2.0.0 publish. When v2 lands, add a parallel
+# step that verifies the v2 hash against the Rust pipeline.
 
 name: pip-release
 
@@ -47,9 +49,7 @@ on:
     tags:
       - "v*-pip"
 
-# Required for PyPI Trusted Publisher (OIDC).
 permissions:
-  id-token: write
   contents: read
 
 jobs:
@@ -193,12 +193,6 @@ jobs:
         startsWith(github.ref, 'refs/tags/v2.')
       )
     runs-on: ubuntu-latest
-    # PyPI Trusted Publisher (OIDC) — register the workflow + repo
-    # under https://pypi.org/manage/account/publishing/ before the
-    # first publish. No API tokens in GH secrets.
-    environment:
-      name: ${{ github.event_name == 'workflow_dispatch' && inputs.publish_to || 'pypi' }}
-      url: https://pypi.org/p/wifi-densepose
     steps:
       - name: Gather all artifacts into dist/
         uses: actions/download-artifact@v4
@@ -214,9 +208,8 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           repository-url: https://test.pypi.org/legacy/
+          password: ${{ secrets.PYPI_API_TOKEN }}
           packages-dir: dist
-          # Don't fail on existing — useful when re-running a dispatch
-          # after fixing the workflow but before bumping the version.
           skip-existing: true
       - name: Publish to PyPI
         if: |
@@ -224,6 +217,7 @@ jobs:
           (github.event_name == 'workflow_dispatch' && inputs.publish_to == 'pypi')
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
+          password: ${{ secrets.PYPI_API_TOKEN }}
           packages-dir: dist
 
   publish-tombstone:
@@ -237,9 +231,6 @@ jobs:
         startsWith(github.ref, 'refs/tags/v1.99')
       )
     runs-on: ubuntu-latest
-    environment:
-      name: ${{ github.event_name == 'workflow_dispatch' && inputs.publish_to || 'pypi' }}
-      url: https://pypi.org/p/wifi-densepose
     steps:
       - uses: actions/download-artifact@v4
         with:
@@ -250,6 +241,7 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           repository-url: https://test.pypi.org/legacy/
+          password: ${{ secrets.PYPI_API_TOKEN }}
           packages-dir: dist
           skip-existing: true
       - name: Publish to PyPI
@@ -258,4 +250,5 @@ jobs:
           (github.event_name == 'workflow_dispatch' && inputs.publish_to == 'pypi')
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
+          password: ${{ secrets.PYPI_API_TOKEN }}
           packages-dir: dist