Enable trusted publishing

[PastelStorm]

Note

Low Risk
CI/release pipeline change with a version bump; low code/runtime impact, but could affect publishing if PyPI trusted publishing is misconfigured.

Overview
Switches the release workflow to PyPI trusted publishing (OIDC) by removing the PYPI_API_TOKEN credential from the pypa/gh-action-pypi-publish step.

Bumps the package version to 1.5.2 and updates the changelog accordingly, plus refreshes uv.lock with minor dependency updates (e.g., filelock, platformdirs, ruff).

^{Written by Cursor Bugbot for commit 0706eca. This will update automatically on new commits. Configure here.}