Here's how I fixed the pygeoprocessing 2.3.3 release (with much help from James):
I uploaded an invalid sdist tarball to the 2.3.3 release on GitHub and PyPI.
I created a post release with the right sdist file. I repeated the entire release process with the version number 2.3.3.post0: updating HISTORY.rst, PRing that into main, pushing the new tag, waiting for artifacts to build, and uploading them to Github and PyPI.
I then yanked the 2.3.3 release on PyPI. This seems to be the best practice when a release is broken: PEP 592