ci(ffi): cross-platform Python wheels + PyPI publishing

[Nic-dorman]

Stacked on #228 (base = feat/python-ffi). Draft until #228 lands — review the bindings there first. GitHub will retarget this to main automatically when #228 merges.

What

The release pipeline for the Python bindings added in #228: reproducible per-platform wheel builds + publishing via PyPI Trusted Publishing (OIDC, no stored token).

Build scripts

CI runs the same script a developer runs locally — one source of truth:

• build-wheel-manylinux.sh — compiles the native lib inside a manylinux_2_28 container (glibc 2.28) so the wheel installs on RHEL8 / Ubuntu 20.04+ / Debian 10+; auditwheel verifies + retags. Arg: x86_64 | aarch64.
• build-wheel-macos.sh — builds arm64 + x86_64, lipo-fuses to a universal2 wheel (deployment target 11.0); delocate verifies self-contained.
• build-wheel-windows.ps1 — native x86_64 DLL; delvewheel bundles non-system DLLs.

Workflow (publish-python.yml)

• Matrix: linux x86_64 (ubuntu-latest), linux aarch64 (ubuntu-24.04-arm, native — no QEMU), macOS universal2 (macos-latest), windows amd64.
• Triggers: push tag python-v<ver> → build + publish to PyPI; or manual dispatch with publish = none | testpypi | pypi (none = matrix smoke test, no upload).
• Publishes via OIDC into a GitHub environment (pypi / testpypi).

Proven

• linux-x86_64 and macOS-universal2 wheels build, are auditwheel/delocate-honest, and install + run in clean environments (incl. debian:11 / glibc 2.31).
• linux-aarch64 and Windows validate on first CI dispatch (no local hardware for either).

Before first publish (maintainer action)

1. Create GitHub environments pypi and testpypi.
2. Register a PyPI and TestPyPI pending publisher: project ant-ffi, owner WithAutonomi, repo ant-sdk, workflow publish-python.yml, environment pypi / testpypi.

The workflow is inert until then (only runs on a python-v* tag or manual dispatch). Suggested first run: dispatch with publish=testpypi to exercise the full matrix end-to-end.

🤖 Generated with Claude Code