Switch PyPI publish to classic API token (org secret), bump to v0.1.1

Trusted-publishing OIDC hit a persistent invalid-publisher error across
the whole fleet. Using PYPI_API_TOKEN as a stopgap; can flip back to
OIDC once a version has published successfully once.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>