refactor(ci): use download-dists for the artifact half

Reworks the previous commit. Composite actions were not the problem --
one creates no new workflow context, so the job keeps this repo's own
OIDC identity, which is why it works where a reusable workflow does not.
Only pypa/gh-action-pypi-publish had to come out of it, because nesting
a Docker container action makes GitHub resolve its image against the
wrapping action's repository.

So the download goes back to a shared action, renamed download-dists
now that it no longer publishes, and only the publish step stays inline.

Still pinned at @main here; reqstool/.github#94 has to merge before a
commit SHA exists to pin to. That pin lands before this PR merges.

Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>

Author: jimisola

.github/workflows/release.yml

@@ -109,10 +109,12 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/download-artifact@v8.0.1
+      - uses: reqstool/.github/.github/actions/download-dists@main
         with:
-          name: dist-tagged
-          path: dist
+          artifact: dist-tagged
+      # Inline, not inside download-dists: nesting this Docker action in a
+      # composite action makes GitHub resolve its image against the wrapper's
+      # repo. See reqstool/.github#95.
       - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           attestations: true