Use `publication` to avoid leaking private implementation details

[whitequark]

https://pypi.org/project/publication/

We've had many problems with that in the past: a name would be imported from somewhere it only existed on accident, and a release would unintentionally break downstream code.

It seems like there are some issues with publication, so perhaps we should hold off on it for now?