Release readiness helper rejects existing trusted publishing workflow #13

The existing scripts/verify_release_ready.py::check_github_workflow returns False because it requires the literal PYPI_API_TOKEN in .github/workflows/publish.yml. The current workflow uses pypa/gh-action-pypi-publish with OIDC trusted publishing and id-token: write, so that token requirement is not its publication contract.

Observed while preparing the 1.1.9 source-readiness release (PR12). Version/build/metadata and twine checks pass; this legacy helper failure is preserved. Fix the helper to validate the actual supported publication declaration without weakening missing-workflow or missing-authentication rejection. No publishing or tag change is requested by this issue.