[no-ci] CI: harden pip in release.yml and retire release-cuda-pathfinder.yml

.github/RELEASE-core.md

@@ -26,22 +26,12 @@ of `ci/tools/check_release_notes.py` that writes `version=<VERSION>` to
 `GITHUB_OUTPUT`. The release-notes job rejects an empty version before
 documentation, asset uploads, or package publication can start. Pathfinder
 package publication also requires successful draft metadata preparation.
-Use the retained legacy Pathfinder workflow for older tags without version
-output support during the transition; do not move existing tags to add the
-updated checker.
 
 The default `dry-run` action validates preparation, builds docs, and
 collects release artifacts without creating a GitHub Release or publishing
 packages. It can be dispatched from a development branch; use
 `dry-run-docs-branch` only when a preview deployment is needed.
 
-Before the first Pathfinder release through this workflow, its trusted
-publishers on **both PyPI and TestPyPI** must authorize `release.yml`.
-Until that migration is complete, `release-cuda-pathfinder.yml` remains
-available. Keep its existing publisher
-registrations during the transition; retire the old workflow and its
-registrations after the consolidated workflow is authorized on both indexes.
-
 Each section below provides detailed guidance for a step in the
 [Release Checklist](ISSUE_TEMPLATE/release_checklist.yml). To start a
 release, create a new issue from that template and work through it item by

.github/actionlint.yaml

@@ -23,6 +23,9 @@ paths:
       - 'unexpected key "queue" for "concurrency" section'
   # GitHub supports self-repository ($/) action references, but the latest
   # actionlint release does not yet recognize them (rhysd/actionlint#711).
+  ".github/workflows/release.yml":
+    ignore:
+      - 'specifying action "\$/[^"]+" in invalid format because ref is missing'
   ".github/workflows/test-wheel-linux.yml":
     ignore:
       - 'specifying action "\$/[^"]+" in invalid format because ref is missing'