Rename distro to dash0-opentelemetry and publish each package to PyPI from its own environment

[ocelotl]

What this does

A single, self-contained change that:

1. Renames the distro dash0-opentelemetry-distro → dash0-opentelemetry (for parity with Ruby dash0-opentelemetry and JS @dash0/opentelemetry; see Rename main package to dash0-opentelemetry #41). This is Michele's rename commit from chore: rename distro to dash0-opentelemetry and add PyPI trusted publishing #42, carried here unchanged.
2. Adds per-package PyPI publishing to release.yml: on a tagged release, every package built that run is uploaded to public PyPI via Trusted Publishing (OIDC), each from its own GitHub environment.

It supersedes #42 (same rename) + #43 (the publishing mechanism), combined so the rename and the correct publishing land together.

Why one environment per package (load-bearing)

A PyPI pending trusted publisher is unique on (owner, repo, workflow, environment) — only one may exist per tuple, and a second for a different project name is rejected. So a single shared pypi environment could authorize only one of our names. Giving each package its own environment (named after its PyPI project name) makes each tuple distinct, which is what lets this one workflow publish all five. Refs: warehouse #16920, PyPI trusted-publisher docs.

How the publishing works

• The build job now outputs packages: the JSON array of PyPI project names actually built this run (from the existing workspace-derived to_build — already-indexed filenames are skipped, so nothing is re-published).
• A new publish-pypi job fans out with strategy.matrix.package over that array. Each leg:
  • runs in environment: <package name> (so the OIDC token carries that environment claim),
  • downloads only that package's wheel + sdist (dash0_opentelemetry-* vs dash0_opentelemetry_pyproto-* is unambiguous after filename normalization),
  • publishes via pypa/gh-action-pypi-publish, SHA-pinned to dc37677 (v1.14.2) — resolving the unpinned-action TODO, consistent with this repo's "third-party actions are SHA-pinned" posture.
• Guards: tag pushes only, build succeeded, and skipped entirely when nothing was built (packages == '[]').
• Environment names are derived from each package's [project].name — no hardcoded list to drift.

Prerequisites before this can run (not in this PR)

1. On PyPI — one pending (later active) trusted publisher per package, each bound to repo dash0hq/opentelemetry-python-distribution, workflow release.yml, and environment = the package's project name:

   • dash0-opentelemetry
   • dash0-opentelemetry-pyproto
   • dash0-opentelemetry-exporter-otlp-pyproto-common
   • dash0-opentelemetry-exporter-otlp-pyproto-http
   • dash0-opentelemetry-exporter-otlp-pyproto-grpc

   (Delete the current single dash0-opentelemetry / pypi pending publisher and recreate the five above with these distinct environments.)

2. On GitHub — those five environments must exist (Settings → Environments) with whatever reviewer/branch protections are desired. Reviewer gates apply per environment, so a release pauses for approval once per package.

Notes

• Draft: keep until the PyPI-side publishers and the GitHub environments are in place.
• Relates to OSS-38.