ci: require pypi environment for releases

[innsd]

Summary

• bind the PyPI release job to the pypi GitHub Actions environment
• document that PYPI_API_TOKEN should be configured as an environment secret
• recommend environment reviewers and v* tag restrictions for release hardening

Validation

• parsed .github/workflows/release-pypi.yml with PyYAML
• pre-commit hooks passed during commit

Follow-up configuration

Before the next release, create a GitHub Actions environment named pypi, move PYPI_API_TOKEN into that environment as an environment secret, and optionally configure required reviewers.

[cuericlee]

/lgtm