[ci] Harden the wheels workflow and cibuildwheel configuration

[aaronj0]

Various suite of mechanical and workflow improvements based on some research on the standards followed by scipy/numpy/pybind11:

Workflow hardening:

• persist-credentials: false on every checkout
• if-no-files-found: error on every artifact upload
• zizmor.yml records the action-pin policy

Artifact integrity:

• Every wheel is twine-checked via cibuildwheel's audit hook and validated against a zip-member allowlist on all platforms, so nothing unexpected ships.
• The build must leave the checkout unmutated (git diff --exit-code, plus the pybind-template check).
• The sdist is twine-checked.

sdist is now tested:

• New test-sdist job stages the recipe LLVM, pip-installs the tarball, and runs the smoke and full suites. This matches what numpy and scipy do.

cibuildwheel config fixes:

• PYTHONSAFEPATH=1 in the test env, so imports resolve from the installed wheel rather than the source tree.
• Host-mount disabled in the build container.
• macOS requirements install moved to before-test.
• sdist excludes added.
• cp314t/cp315 exclusions documented as policy (verified against v4.2.0 defaults).
• archs = ["auto64"] with the macos-x86_64 cell: native runners only, no cross-compilation.

[guitargeek]

Thanks a lot!

Consider adding Python 3.15 wheels as well (in a follow-up PR) since the release candidate was published last month: https://blog.python.org/2026/08/python-3150-rc1/

[guitargeek]

I thought the Python developers recommend the package maintainers to build wheels as soon as the Python release candidate is out? Python 3.15 RC 1 is out already I think.

[aaronj0]

Indeed a good idea! I'll follow up with a 3.15 rc wheel matrix. That will need extending the ci-workflows wheels job as we maintain the build-images on that repo. Do you want to drop the policy comments?

[aaronj0]

Comments have been cleaned up

[github-actions]

Test Results

Configuration	Result
macos-26-intel-llvm21-py3.14-cxx20	===== 473 passed, 44 skipped, 84 xfailed, 100 warnings in 72.76s (0:01:12) =====
macos-26-llvm21-py3.14-cxx20	========== 477 passed, 30 skipped, 94 xfailed, 100 warnings in 40.20s ==========
ubuntu-24.04-llvm21-py3.14-cxx20-vg	============ 558 passed, 25 skipped, 18 xfailed in 65.25s (0:01:05) ============
ubuntu-24.04-llvm22-py3.14-cxx20	============ 557 passed, 25 skipped, 19 xfailed in 77.56s (0:01:17) ============
ubuntu-24.04-llvm22-py3.14-cxx20-cling	============ 549 passed, 25 skipped, 27 xfailed in 78.52s (0:01:18) ============
ubuntu-24.04-llvm22-py3.14-cxx23	============ 578 passed, 3 skipped, 20 xfailed in 79.33s (0:01:19) =============