ci: prepare repo for Fern generation cutover

.fernignore

@@ -0,0 +1,4 @@
+# Files Fern must not overwrite or delete when regenerating this repo.
+LICENSE
+SECURITY.md
+.github/workflows/publish-pypi.yml

.github/workflows/publish-pypi.yml

@@ -1,6 +1,9 @@
-# This workflow is triggered when a GitHub release is created.
-# It can also be run manually to re-publish to PyPI in case it failed for some reason.
-# You can run this workflow by navigating to https://www.github.com/Vitable-Inc/vitable-connect-python/actions/workflows/publish-pypi.yml
+# Publishes the Fern-generated SDK to PyPI via OIDC trusted publishing (the
+# PyPI project trusts this repo + workflow file + `prod` environment; no
+# token). Triggered when a GitHub release is published, or manually to
+# re-publish after a failure.
+#
+# This file is listed in .fernignore so Fern regeneration preserves it.
 name: Publish PyPI
 on:
   workflow_dispatch:
@@ -11,20 +14,26 @@ on:
 jobs:
   publish:
     name: publish
+    # Keep in sync with the PyPI trusted publisher registration, which pins
+    # this environment name.
     environment: prod
     runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v5
 
-      - name: Install uv
-        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+      - name: Set up Python
+        uses: actions/setup-python@v6
         with:
-          version: '0.9.13'
+          python-version: "3.11"
 
-      - name: Publish to PyPI
+      - name: Build distribution
         run: |
-          bash ./bin/publish-pypi
+          pip install poetry
+          poetry build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1