GRM-95: refactor: consolidate publish.yml into post-merge.yml

AGENTS.md

@@ -234,8 +234,9 @@ Vikunja task updates:
    non-release commits (not just when release succeeds), so infrastructure-only
    changes still update the task tracker.
 
-The tag push triggers the **publish workflow** (`.gitea/workflows/publish.yml`)
-which builds and publishes the package to PyPI.
+6. **publish** — Runs after release succeeds (needs: release). Builds and
+   publishes the package to the Gitea PyPI registry. Gets the tag from the
+   release job's `tag` output.
 
 ### Smart CI: User-Facing vs Workflow-Only Changes
 
@@ -356,11 +357,11 @@ platform matrix. Both `devx.molecule.distribute_molecule` (CI) and
 `devx.molecule.molecule_all` (dev tool) import `PLATFORMS` from it — this
 avoids dev tools importing directly from CI modules.
 
-2. **Publish workflow** (`.gitea/workflows/publish.yml`):
-   - Triggers on tag push (`v*`)
-   - Validates `PYPI_TOKEN` is set (warns if missing)
+2. **Publish job** (in `post-merge.yml`, needs: release):
+   - Runs after the release job creates a tag
+   - Gets the tag from `needs.release.outputs.tag`
    - Builds the Python package
-   - Optionally publishes to PyPI (if `PYPI_TOKEN` is set)
+   - Publishes to the Gitea PyPI registry
    - Creates a Gitea release with git-cliff-generated release notes
    - On failure, creates a Gitea issue via `devx.ci.notify_failure`