Fix publish release workflow (#4600)

* ci: fix publish release workflow

- Add sudo to apt-get calls (runner is non-root)
- Add contents: write permission for uploading release assets
- Drop uv sync before uv build (unnecessary)
- Replace archived upload-release-asset action and redundant
  Python/requests API script with gh release upload; tag name
  is available directly from the release event context
- Strip leading v from tag name to match built artifact filename

* ci: set bash shell for release asset upload step

.github/workflows/python-publish.yml

@@ -11,6 +11,7 @@ jobs:
     environment: release
     permissions:
       id-token: write
+      contents: write
 
     steps:
     - uses: actions/checkout@v6
@@ -28,7 +29,6 @@ jobs:
 
     - name: Build and push release to PyPI
       run: |
-        uv sync
         uv build
         uv publish
 
@@ -37,37 +37,11 @@ jobs:
       with:
           path: dist/*.tar.gz
           name: manim.tar.gz
-    - name: Install Dependency
-      run: pip install requests
-    - name: Get Upload URL
-      id: create_release
-      shell: python
-      env:
-          access_token: ${{ secrets.GITHUB_TOKEN }}
-          tag_act: ${{ github.ref }}
-      run: |
-          import requests
-          import os
-          ref_tag = os.getenv('tag_act').split('/')[-1]
-          access_token = os.getenv('access_token')
-          headers = {
-              "Accept":"application/vnd.github.v3+json",
-              "Authorization": f"token {access_token}"
-          }
-          url = f"https://api.github.com/repos/ManimCommunity/manim/releases/tags/{ref_tag}"
-          c = requests.get(url,headers=headers)
-          upload_url=c.json()['upload_url']
-          with open(os.getenv('GITHUB_OUTPUT'), 'w') as f:
-            print(f"upload_url={upload_url}", file=f)
-            print(f"tag_name={ref_tag[1:]}", file=f)
 
     - name: Upload Release Asset
-      id: upload-release
-      uses: actions/upload-release-asset@v1
+      shell: bash
       env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: dist/manim-${{ steps.create_release.outputs.tag_name }}.tar.gz
-          asset_name: manim-${{ steps.create_release.outputs.tag_name }}.tar.gz
-          asset_content_type: application/gzip
+      run: |
+        TAG=${{ github.event.release.tag_name }}
+        gh release upload "$TAG" "dist/manim-${TAG#v}.tar.gz"