ci: move id-token permission to the publishing job

The permissions block landed on build_sdist, which only builds an sdist. The
pypi-publish job runs gh-action-pypi-publish and had no permissions at all, so
ACTIONS_ID_TOKEN_REQUEST_TOKEN was unset and the OIDC exchange failed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: TheGupta2012

.github/workflows/pre-release.yml

@@ -123,9 +123,6 @@ jobs:
   build_sdist:
     name: Source distribution
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write  # mint the OIDC token PyPI trusted publishing verifies
-      contents: read  # actions/checkout
 
     steps:
       - name: Checkout Pyqasm
@@ -160,6 +157,9 @@ jobs:
     needs: [build_wheels, build_sdist]
     runs-on: ubuntu-latest
     environment: release
+    permissions:
+      id-token: write  # mint the OIDC token PyPI trusted publishing verifies
+      contents: read  # actions/checkout
 
     steps:
       - name: Checkout Pyqasm

.github/workflows/release.yml

@@ -119,9 +119,6 @@ jobs:
   build_sdist:
     name: Source distribution
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write  # mint the OIDC token PyPI trusted publishing verifies
-      contents: read  # actions/checkout
 
     steps:
       - name: Checkout PyQASM
@@ -151,6 +148,9 @@ jobs:
     needs: [build_wheels, build_sdist]
     runs-on: ubuntu-latest
     environment: release
+    permissions:
+      id-token: write  # mint the OIDC token PyPI trusted publishing verifies
+      contents: read  # actions/checkout
 
     steps:
       - name: Checkout PyQASM