uncomment pypi publish job, gated on manual environment approval

netsleuth confirmed free on PyPI (pypi.org/pypi/netsleuth/json -> 404).
Publish still can't run until a PyPI Trusted Publisher is registered for
this project and the pypi GitHub environment exists with a reviewer rule -
both need account access this session doesn't have.

.github/workflows/release.yml

@@ -35,32 +35,29 @@ jobs:
           name: dist
           path: dist/
 
-  # Publishing is intentionally a separate, manually-approved job.
+  # Publishing is intentionally a separate, manually-approved job: a tag push
+  # builds and tests automatically, but a human still has to approve the
+  # `pypi` environment before this job runs and actually publishes.
   #
-  # RENAMED as of 2026-08-09: the distribution name "netcheck" was already
+  # "netsleuth" confirmed free on PyPI 2026-08-09 (pypi.org/pypi/netsleuth/json
-  # taken on PyPI by an unrelated project (Netchecks / hardbyte, a cloud-native
+  # -> 404). Before the first tag push actually publishes, still needed:
-  # network-assertion tool, https://pypi.org/project/netcheck/). `pyproject.toml`'s
+  #   1. Register a PyPI Trusted Publisher for this not-yet-published project
-  # [project] name has been changed to "netsleuth" — see TASKS.md.
+  #      name at https://pypi.org/manage/account/publishing/ — no token needed,
-  #
+  #      this workflow's OIDC identity gets authorized directly on pypi.org.
-  # Still needed before this job can be enabled:
+  #      Owner: Horizontal42, repo: netsleuth, workflow: release.yml,
-  #   1. Confirm "netsleuth" is actually free on PyPI (fresh availability check —
+  #      environment: pypi.
-  #      it was only checked against the old name).
+  #   2. Create the `pypi` GitHub Environment (repo Settings → Environments)
-  #   2. Set up PyPI Trusted Publishing for the new project name
+  #      with a required-reviewer protection rule, so publishing needs a
-  #      (https://docs.pypi.org/trusted-publishers/) — no token needed, this
+  #      manual click even after the workflow triggers.
-  #      workflow's OIDC identity gets authorized directly on pypi.org.
+  publish:
-  #   3. Uncomment the job below and give it an `environment: pypi` protection
+    needs: build-and-test
-  #      rule requiring manual approval, so a tag push builds automatically
+    runs-on: ubuntu-latest
-  #      but a human still has to click "publish."
+    environment: pypi
-  #
+    permissions:
-  # publish:
+      id-token: write
-  #   needs: build-and-test
+    steps:
-  #   runs-on: ubuntu-latest
+      - uses: actions/download-artifact@v4
-  #   environment: pypi
+        with:
-  #   permissions:
+          name: dist
-  #     id-token: write
+          path: dist/
-  #   steps:
+      - uses: pypa/gh-action-pypi-publish@release/v1
-  #     - uses: actions/download-artifact@v4
-  #       with:
-  #         name: dist
-  #         path: dist/
-  #     - uses: pypa/gh-action-pypi-publish@release/v1