Fix missing cp314 wheels on PyPI (#13949)

[bertonha]

Problem

Fixes #13949. The v3.8.14 and v3.8.15 GitHub releases each have 40 assets, but PyPI received only 30. The 10 missing files are exactly the last-uploaded batch:

• all 8 cp314 wheels
• the cp313 win_arm64 wheel
• the sdist (.tar.gz)

Root cause

publish_pypi.yml downloaded release assets with robinraju/release-downloader, which reads only the first page of a release's assets. GitHub paginates the release-assets listing at 30 per page (the endpoint returns a Link: …page=2 header and only 30 items), so the tail was never fetched and never uploaded to PyPI — even though all 40 files are present on the GitHub release.

This regressed when the action was pinned from the floating @v1 tag to a specific SHA (v1.12) for supply-chain hardening in 4216738. v3.8.13 was published before that pin and got all 40 files; v3.8.14 was the first release after it and lost the tail.

Fix

• Replace the downloader action with gh release download, which paginates correctly (verified locally: it fetches all 40 assets, including every cp314 wheel and the sdist).
• Add a verification step that compares the number of downloaded files against the release's asset count and fails the job on mismatch, so a partial upload can never silently reach PyPI again.

Note

This workflow only runs on new release publications, so the already-affected v3.8.14/v3.8.15 wheels won't appear on PyPI retroactively — those need a one-off manual gh release download + twine upload of the missing files.

🤖 Generated with Claude Code