dev/release: explore trusted publishing mechanisms

### What feature or improvement would you like to see?

Currently we have maintainers deploy release artifacts with API keys, but package indices are encouraging workflows that are more secure and don't depend on this.

Start by documenting how maintainers currently deploy release artifacts with API keys and which package indices are involved. Compare the trusted-publishing mechanisms those indices encourage, then define a concrete replacement and verification criteria for secure releases.

Written by the indexing model from the issue text.