fix(publish): pypi trusted publishing always requests the pypi audience #1344

What is wrong

pypi_oidc::mint always requests the GitHub OIDC token with audience=pypi (AUDIENCE const,

Warehouse instances do not share an audience: TestPyPI expects testpypi, and each index advertises its own at https://<host>/_/oidc/audience (this is what pypa/gh-action-pypi-publish queries). So with url: https://test.pypi.org/legacy/ and trustedPublishing: true, the exchange at https://test.pypi.org/_/oidc/mint-token is refused, and the error tells the user to check their trusted publisher registration, which is not the problem.

The config docs say the opposite: "The token endpoint is derived from the registry url, so TestPyPI and a private index work unchanged" (docs/site/docs-en/configuration/config-file.md:1084).

Suggested fix

GET https://<host>/_/oidc/audience first and request the OIDC token with the returned audience, falling back to pypi only for pypi.org if the call fails. Add a test against the test server for a non-default audience.