Configure PyPI trusted publishing for CI releases

## Context

`meridian-energy` **0.1.4** was published manually via `twine` + `~/.pypirc`.

CI already has a release publish job (`.github/workflows/ci.yml`) using `pypa/gh-action-pypi-publish` with `id-token: write`, but PyPI trusted publishing is not wired up yet — so the job will fail until a publisher is registered.

## Goal

Publishing a GitHub Release (`vX.Y.Z`) should upload to PyPI with no long-lived API token in GitHub secrets or local `.pypirc`.

## Steps

1. On [PyPI → meridian-energy → Publishing](https://pypi.org/manage/project/meridian-energy/settings/publishing/):
- **Add a new pending publisher** (Trusted Publisher → GitHub)
- Owner: `hardbyte`
- Repository: `python-meridian-energy`
- Workflow: `ci.yml` (must match the filename under `.github/workflows/`)
- Environment: leave empty unless we add a GitHub Environment
2. Confirm the workflow `publish` job:
- `permissions: id-token: write`
- runs only on `release: types: [published]`
- uses `pypa/gh-action-pypi-publish`
3. Optional hardening (match `python-evnex` if desired):
- GitHub Environment `pypi` with required reviewers
- `attestations: write` + artifact attestation
- `uvx twine check --strict dist/*` before upload
4. Smoke test: cut a **patch** release (e.g. empty bump or docs-only `0.1.5`) and confirm the publish job goes green without secrets.

## Acceptance

- [ ] Trusted publisher configured on PyPI for this repo/workflow
- [ ] Next GitHub Release publishes to PyPI automatically
- [ ] No PyPI API token stored in GitHub Actions secrets for this repo

## Refs

- https://docs.pypi.org/trusted-publishers/
- https://github.com/pypa/gh-action-pypi-publish
- Existing workflow: `.github/workflows/ci.yml` (`publish` job)

Start by inspecting the `publish` job in `.github/workflows/ci.yml` and the PyPI Trusted Publishers documentation. Register the `hardbyte/python-meridian-energy` repository and `ci.yml` workflow on PyPI, then cut a patch or docs-only release to verify the job publishes successfully without API-token secrets.

Written by the indexing model from the issue text.