ci: update PyPI publisher for Metadata 2.4 artifacts #449

Summary

The v0.5.0 PyPI publication run fails inside pypa/gh-action-pypi-publish before upload because the pinned publisher container uses Twine 5.1.0/pkginfo 1.10.0, which rejects the valid wheel metadata generated by setuptools 84.0.0 (Metadata-Version: 2.4).

Evidence

• Release run: https://github.com/basefoundry/base-cli/actions/runs/37979084299
• Publish job: https://github.com/basefoundry/base-cli/actions/runs/37979084299/job/113985688332
• Failure: InvalidDistribution: Metadata is missing required fields: Name, Version
• The reviewed wheel contains Name: base-cli and Version: 0.5.0; no package was uploaded.

Acceptance criteria

• Update the pinned PyPI publisher action to a version whose bundled Twine supports Metadata-Version 2.4.
• Re-run the immutable v0.5.0 publication workflow without rebuilding or changing the tag.
• Verify both PyPI artifacts, checksums, attestations, and the GitHub release.
• Keep the release-build toolchain security fix from security: refresh vulnerable release build dependencies before 0.5.0 #447 intact.