How can someone patch Bitcoin?
As amaclin said, anyone can download the code from github and make their own changes to their copy, to run a customized version. Obviously some changes would make their version incompatible with the rest of the network nodes (consensus changes) though.
I've read there is a few people that have access to publish new code (?).
Indeed, the bitcoin organisation on GitHub is made up of members who contribute more actively to the codebase, some of them have write access to the code (e.g. laanwj, sipa, MarcoFalke and jonasschnelli) meaning they can actually merge other people's pull requests (suggested changes).
Why are those people trusted?
"Open source often naturally revolves around meritocracy where longer term contributors gain more trust from the developer community. However, some hierarchy is necessary for practical purposes. As such there are repository “maintainers” who are responsible for merging pull requests as well as a “lead maintainer” who is responsible for the release cycle, overall merging, moderation and appointment of maintainers." [reference]. But this doesn't mean they just do whatever they want to. "Maintainers will take into consideration if a patch is in line with the general principles of the project; meets the minimum standards for inclusion; and will judge the general consensus of contributors." And as amaclin said, everyone has a right not to trust them, that is the beauty of open source development, anyone can read/modify/test the code and make sure they trust it, not just the people who wrote it.
And how would they publish the new code so every node gets the updated version? Does every node download it from some central server? Or does someone push it?
Releases are made periodically by the lead maintainer, such as the latest 0.15.0.1 release. The executables for that release get published on bitcoin.org so that anyone can download the new release and run it instead of the older software. But upgrading to a new version is always a choice, people can choose to keep using older software in most cases if they want to.
In both cases, it doesn't seem decentralized.
Because bitcoin is completely open source, anyone can make changes to the code themselves and run their own versions, no one is forced to trust the bitcoin core repo or use its compiled binaries. Anyone can run their own versions of the software, anyone can fork it and make their own clients, anyone can choose not to upgrade, etc.