What

• Project name in the `pypi` environment URL was `nullrun-sdk`; the actual
  PyPI project is `nullrun` (per `pyproject.toml` `name = "nullrun"`).
• Stale comment referenced the old `maltsev-dev/nullrun-sdk` repo; updated
  to point at `nullrunio/nullrun-sdk-python`.
• Removed the dead "Variant 2: API token" block — we use Trusted Publishing
  only, no API token should ever be set as a secret.
• Added a `workflow_dispatch:` trigger for manual emergency re-publishes.

Why

The bootstrap workflow was written when this lived in
`maltsev-dev/nullrun-sdk`. After the repo move to `nullrunio/nullrun-sdk-python`
the project name mismatch means `gh-action-pypi-publish` would publish under
the wrong project URL on the `pypi` environment page, and the stale comment
would mislead the next reader.

Test plan

• Approve and merge this PR.
• On pypi.org → Project → Publishing → Add a new pending publisher:
  • Owner: `nullrunio`
  • Repository: `nullrun-sdk-python`
  • Workflow filename: `publish.yml`
  • Environment name: `pypi`
• Tag a release (`git tag v0.3.0 && git push --tags`) and verify the
  publish job runs end-to-end without errors.