Add PyPI publish attestations on release

[shaanmajid]

Summary

Hi! This switches the release upload step from uv publish to pypa/gh-action-pypi-publish@v1.14.0.

python-frontmatter already publishes from GitHub Actions using PyPI Trusted Publishing/OIDC. Using the official PyPA publish action keeps that flow, but also generates and uploads PyPI publish attestations by default, so this shouldn't require any new PyPI-side configuration or secrets. Those attestations bind each uploaded distribution to the GitHub Actions workflow that published it, giving PyPI and downstream users stronger provenance for the release artifacts.

Possible follow-ups

I kept this PR intentionally small for reviewability, but noticed a few related release-hardening opportunities while looking at the workflow:

• Pin GitHub Actions to full commit SHAs. GitHub recommends this in its Actions security hardening guidance, since tags can move or be compromised.
• Drop enable-cache: true on setup-uv in the deploy job. Avoiding cache in the publish flow reduces cache-poisoning risk around artifacts being published to PyPI.
• Split build and publish into separate jobs, so id-token: write is only available in the final upload job. This is recommended by both the pypa/gh-action-pypi-publish and astral-sh/attest-action docs.

Happy to make any of these here or in follow-up PRs, whichever you prefer.

Testing

Not run; workflow-only change.