Use the PyPI token secret for DeepGym releases

Switch the DeepGym publish job from trusted publishing to token-based publishing via the pypi environment secret so release tags can publish immediately without additional PyPI-side trusted publisher setup.

Constraint: The current PyPI project rejected GitHub trusted publishing for DeepGym/deepgym with invalid-publisher, while a project-scoped token is now available in the workflow environment
Rejected: Keep trusted publishing and wait for manual PyPI-side reconfiguration | blocks the requested release path right now
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: If trusted publishing is re-enabled later, remove the token path explicitly instead of leaving both mechanisms configured implicitly
Tested: Verified GitHub environment secret PYPI_API_TOKEN exists for DeepGym/deepgym environment pypi
Not-tested: End-to-end publish run on the updated workflow commit before push

Author: abhishekgahlot2

.github/workflows/deepgym-ci.yml

@@ -56,8 +56,6 @@ jobs:
     needs: test
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
     environment: pypi
-    permissions:
-      id-token: write
 
     steps:
       - uses: actions/checkout@v4
@@ -78,3 +76,5 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           packages-dir: deepgym/dist/
+          user: __token__
+          password: ${{ secrets.PYPI_API_TOKEN }}