Stabilize release-signing job by removing setup-time action resolution dependencies

[Copilot]

The github-release job in publish.yml failed before step execution (Set up job) due to transient GitHub Action metadata resolution errors (Service Unavailable). This change removes third-party uses: dependencies from that job’s critical path while preserving release signing and asset upload behavior.

• Root cause addressed

  • Sign Python distribution and upload it as GitHub Release depended on external action download during job setup, which is where the run failed.

• Workflow hardening in github-release

  • Replaced actions/download-artifact with gh run download to fetch python-package-distributions.
  • Replaced sigstore/gh-action-sigstore-python with direct sigstore CLI installation + invocation.
  • Added actions: read permission required by gh run download.

• Signing logic robustness

  • Discover artifacts via find (*.tar.gz, *.whl) instead of relying on glob expansion behavior.
  • Added explicit empty-artifact guard and per-file signing log output.

- name: Download artifacts
  run: |
    gh run download \
      '${{ github.run_id }}' \
      --name python-package-distributions \
      --dir dist/ \
      --repo '${{ github.repository }}'

- name: Sign the dists with Sigstore
  run: |
    mapfile -t files < <(find ./dist -maxdepth 1 -type f \( -name '*.tar.gz' -o -name '*.whl' \) | sort)
    for file in "${files[@]}"; do
      python3 -m sigstore sign "${file}"
    done