ci: remove workflow_call from publish, simplify release (#64)

PyPI trusted publishing doesn't work with reusable workflow calls.
Tag push from release-please (via app token) triggers publish directly.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: FBumann

.github/workflows/publish.yaml

@@ -3,14 +3,9 @@ name: Publish
 on:
   push:
     tags: ["v*"]
-  workflow_call:
-    inputs:
-      tag:
-        required: true
-        type: string
 
 concurrency:
-  group: publish-${{ inputs.tag || github.ref_name }}
+  group: publish-${{ github.ref_name }}
   cancel-in-progress: false
 
 permissions:
@@ -29,7 +24,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.tag || github.ref_name }}
+          ref: ${{ github.ref_name }}
           fetch-depth: 0
 
       - uses: astral-sh/setup-uv@v7

.github/workflows/release.yaml

@@ -12,9 +12,6 @@ jobs:
   release-please:
     name: Release Please
     runs-on: ubuntu-24.04
-    outputs:
-      release_created: ${{ steps.release.outputs.release_created }}
-      tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
       - uses: actions/create-github-app-token@v2
         id: app-token
@@ -28,14 +25,3 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
           config-file: .release-please-config.json
           manifest-file: .release-please-manifest.json
-
-  publish:
-    needs: release-please
-    if: needs.release-please.outputs.release_created
-    permissions:
-      id-token: write
-      contents: write
-      attestations: write
-    uses: ./.github/workflows/publish.yaml
-    with:
-      tag: ${{ needs.release-please.outputs.tag_name }}