ci(core): publish dev releases via trusted publishing

The first live run of the repaired pipeline reached the publish step
and failed with invalid-publisher: the PYPI_TOKEN secret no longer
exists, so the action fell back to OIDC, and PyPI has no trusted
publisher registered for dev-release.yml. Stable releases already
publish via the release.yml trusted publisher (the 0.22.1 run shows
attestation generation). Drop the dead password input so the OIDC path
is explicit; the remaining step is registering dev-release.yml as a
trusted publisher on the PyPI project, which only a project owner can
do.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G4rbaeHJN3L7CREp5v38J9
Signed-off-by: phernandez <paul@basicmachines.co>

Author: phernandez

.github/workflows/dev-release.yml

@@ -71,9 +71,12 @@ jobs:
           # artifact carries the same metadata-free version the gate saw.
           UV_DYNAMIC_VERSIONING_BYPASS="${{ steps.check_version.outputs.version }}" uv build
 
+      # Publishes via PyPI trusted publishing (OIDC) — the PYPI_TOKEN secret no
+      # longer exists (stable releases attest via the release.yml trusted
+      # publisher). Requires a PyPI trusted-publisher registration for
+      # dev-release.yml on the basic-memory project.
       - name: Publish dev version to PyPI
         if: steps.check_version.outputs.is_dev == 'true'
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          password: ${{ secrets.PYPI_TOKEN }}
           skip-existing: true  # Don't fail if version already exists