Add warning for building detection in publish job

[Copilot]

This PR implements a security-focused warning that detects when building appears to be happening in the same job as publishing, which is not a supported pattern and can introduce security risks.

What it does

The implementation adds detection logic to twine-upload.sh that checks for indicators that building is occurring in the publish job:

1. Primary indicator: Presence of .git/ directory (indicates actions/checkout was used)
2. Secondary indicators: Common build files and directories such as:
   • Build configuration files: pyproject.toml, setup.py, setup.cfg, Cargo.toml
   • Source directories: src/, lib/
   • Build artifacts: build/, .tox/, venv/, .venv/
   • Requirements files: requirements.txt, requirements.in

When any of these indicators are detected, the action displays a warning message explaining the security risks and directing users to follow the supported pattern of building in a separate job and downloading artifacts in the publish job.

Why this matters

This aligns with the existing guidance in the README that this action "has nothing to do with building package distributions" and that users should build in separate jobs with restricted privileges. The warning helps enforce this security best practice by making it prominent when users deviate from the supported pattern.

Example warning output

::warning title=Building in publish job detected::The workflow run appears to be building in the same job as publishing. This is not a supported pattern and can be a security risk. Consider moving the build step to a separate job and downloading the artifacts in the publish job instead. Read more: https://docs.pypi.org/trusted-publishers

The detection logic is conservative and only warns when clear indicators of building are present. Clean publish jobs that only contain the packages directory (e.g., after downloading artifacts) will not trigger the warning.

Fixes #324.

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

[Copilot]

@webknjaz 👋 This repository doesn't have Copilot instructions. With Copilot instructions, I can understand the repository better, work faster and produce higher quality PRs.

I can generate a .github/copilot-instructions.md file for you automatically. Click here to open a pre-filled issue and assign it to me. I'll write the instructions, and then tag you for review.