publish.yml sets up Poetry through the setup-poetry composite action

## Summary

Convert `publish.yml` to use `.github/actions/setup-poetry` instead of
repeating the Poetry and Python setup inline.

## Motivation

`.github/actions/setup-poetry/action.yml` was introduced by #406 to
remove exactly this duplication, and `publish.yml` was never converted.
Its steps repeat the action's contents verbatim:

```yaml
- name: install poetry
run: pipx install 'poetry<3'
- name: setup python
uses: actions/setup-python@... # v7
with:
python-version: "3.x"
cache: poetry
```

The Poetry constraint and the `setup-python` pin now live in two places.
A Renovate bump or a Poetry major bump touches one and can leave the
other behind, and the drift only shows up during a release.

## Scope

- Replace the inline install and setup steps in `publish.yml` with
`uses: ./.github/actions/setup-poetry`.
- Pick an explicit `python-version` for the publish job rather than
inheriting `3.x`, or record why a floating version is right for a
release build.

## Acceptance criteria

- [ ] `publish.yml` sets up Poetry through the composite action
- [ ] `pipx install 'poetry<3'` and the `setup-python` pin each appear
once in the repo

## Additional context

#490 (draft) rewrites the publish step for OIDC Trusted Publishing and
keeps the inline setup, so the two changes touch the same file. That
branch is also based on `actions/checkout@v3` and predates the current
v7 pin, so it needs a rebase regardless.

Found in a redundancy and correctness audit of `.github/workflows/` and
`.pre-commit-config.yaml`, alongside #557, #558, and #559.