build: harden just publish with token lookup and dry run

- Move token lookup into scripts/pypi_token.sh, shared by both recipes
- Resolve UV_PUBLISH_TOKEN, then .env, then pass api/packages/pypi
- Fail with a clear hint instead of dropping into an interactive prompt
- Never print the token, only its length
- Gate publish behind version-check so version drift stops the build
- Add publish-dry, same path as publish but with uv publish --dry-run
- Pass --check-url so re-runs skip files already on PyPI
- Hoist dist dir, token entry, and check URL into justfile variables
- Add .env and .env.* to .gitignore

The old recipe sourced .env for credentials, but .env was never ignored, so a token file dropped there would have been committed and shipped inside the sdist.

Verified token precedence for env, .env and password-store, the missing-token exit code, the version-check gate, and a dry run against an unpublished version.

scripts/pypi_token.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Resolve the PyPI token for `uv publish` without ever printing it.
+#
+# Order: an already exported UV_PUBLISH_TOKEN, then .env in the repo root, then
+# the password-store entry passed as $1. The repo intentionally ships no .env,
+# so the password-store path is the normal one on a dev machine.
+
+load_pypi_token() {
+  local entry="${1:-}"
+
+  if [ -z "${UV_PUBLISH_TOKEN:-}" ] && [ -f .env ]; then
+    set -a
+    # shellcheck disable=SC1091
+    source .env
+    set +a
+  fi
+
+  if [ -z "${UV_PUBLISH_TOKEN:-}" ] && [ -n "$entry" ] && command -v pass >/dev/null 2>&1; then
+    UV_PUBLISH_TOKEN="$(pass "$entry" 2>/dev/null | head -1 || true)"
+  fi
+
+  if [ -z "${UV_PUBLISH_TOKEN:-}" ]; then
+    echo "error: no PyPI token found." >&2
+    echo "  export UV_PUBLISH_TOKEN=..., put it in .env, or store it in: pass ${entry:-<entry>}" >&2
+    return 1
+  fi
+
+  export UV_PUBLISH_TOKEN
+  echo "Using PyPI token (${#UV_PUBLISH_TOKEN} chars) for upload."
+}