use PyPI Trusted Publishing (OIDC) and skip-existing for wheel uploads