fix(release): use existing PyPI environment token for 1.0.1

[Si40Code]

Summary

• As explicitly requested by the maintainer, use the existing PYPI_API_TOKEN secret in the pypi environment for publication.
• Remove unused OIDC token permission and disable attestations, which the action supports only with Trusted Publishing. No credentials are copied or exposed.
• Preserve release-only publishing, main/tag and exact-version checks, isolated build artifacts, checksums, metadata/license checks and post-publish verification.
• Prepare patch 1.0.1 without moving the existing v1.0.0 tag. The SDK behavior and OpenAPI contract are unchanged.

Validation

• bash scripts/validate.sh passed: 65 tests, lint, types, examples, hygiene, metadata and fresh wheel/source installs.
• Parsed workflow and verified only the environment-scoped release publish step references the existing secret.
• git diff --check passed.

Token existence is confirmed; its validity will be established by the authorized release job. This replaces the failing Trusted Publisher authentication path rather than silently adding a fallback.