ci: restore Python wheel platform compatibility

[qciaran]

Summary

• restore a genuine macOS 13.0 deployment target while retaining the macOS 15 builders required by the current C++20 toolchain
• build checksum-pinned LLVM 21.1.8 from source for macOS 13 and manylinux 2.28 instead of inheriting newer deployment floors from Homebrew or conda-forge
• build and repair both native Linux packages against manylinux 2.28 with GCC toolset 13
• fail the release workflow if wheel tags or embedded Mach-O minimum versions do not match the intended platform policy
• install, import, and exercise both native wheels across Python 3.10-3.14 on Linux, macOS, and Windows
• include the LLVM redistribution license and cache checksum/script-keyed LLVM archives from trusted branch builds

Context

The LLVM 21 migration raised the published pre-release wheel floor from macOS 13 / manylinux 2.28 to macOS 15 / manylinux 2.34-2.35. That prevents consumers such as qemulator PR #45 from adopting the PECOS 0.9 pre-release without dropping their existing platform support.

The 0.9.0.dev1 release workflow produced exactly the newer-platform artifacts published to PyPI; compatible wheels were not generated and omitted during upload. This change moves the compatibility requirements into executable CI checks so a future toolchain bump cannot silently raise them again.

Validation

• all pre-commit hooks pass locally and in hosted CI
• the GitHub Actions security check passes with the manylinux builder/runtime image pinned to an immutable digest
• Windows produces and validates both win_amd64 native wheels
• Linux builds LLVM 21.1.8 inside the pinned manylinux 2.28 image, then builds, repairs, and validates both native wheels as manylinux_2_28_x86_64
• a local pecos-rslib-llvm wheel performs a real assembly-to-bitcode operation and includes the LLVM 21.1.8 license
• the Mach-O checker rejects the prior dry-run wheels because their embedded macOS 13.2 minimum exceeded the advertised macOS 13.0 policy

Release validation

Dry run 29536734503 proved the source-build strategy and all downstream packaging/runtime jobs, but independent artifact inspection found that its macosx_13_0 wheels still embedded a macOS 13.2 minimum version. Commit f1b65650 lowers the actual target to 13.0 and adds binary-level enforcement.

Dry run 29554048930 is validating the corrected target, every packaged Mach-O load command, LLVM-backed runtime behavior across the full ABI matrix, licensing, and artifact collection.

The macOS 14 hosted runner is only a temporary oldest-runtime check because GitHub is deprecating that image. The deployment-target and wheel-tag checks remain useful after that runner is retired.

[qciaran]

First full release dry run: https://github.com/PECOS-packages/PECOS/actions/runs/29509143430

Findings:

• Windows built and validated both win_amd64 wheels.
• macOS arm64 and x86_64 both produced the intended macosx_13_0_* wheel, but the new post-build guard used python where the macOS runner only exposes python3. Commit 13b8002 fixes the command per platform.
• Linux pecos-rslib built, repaired, and validated as manylinux_2_28_x86_64.
• Linux pecos-rslib-llvm was correctly rejected by auditwheel because conda-forge LLVM 21 currently brings GCC 15 runtime symbols that are too new for manylinux 2.28.

Commit 13b8002 replaces the Linux conda LLVM dependency with a checksum-pinned LLVM 21.1.8 source build compiled inside the pinned manylinux 2.28 image using its baseline system toolchain. A second full release dry run will validate that archive, both repaired wheels, and the actual glibc 2.28 import test.

[qciaran]

Dry run 29518529532 validated the Linux remediation: the source-built LLVM 21.1 completed inside the manylinux 2.28 image, and both pecos-rslib and pecos-rslib-llvm passed their manylinux_2_28_x86_64 tag checks. Both Windows wheels also passed, as did the base macOS wheels at the macOS 13 tag floor. The remaining macOS LLVM-wheel failures were traced to Homebrew LLVM/libzstd carrying a macOS 15 deployment target. Commit 9423a05 applies the same source-build strategy on macOS with CMAKE_OSX_DEPLOYMENT_TARGET=13.2 and external compression libraries disabled; a fresh dry run will validate that change.

[qciaran]

Dry run 29525267133 completed successfully on Linux and Windows for both native wheels. On macOS, both architecture-specific LLVM 21.1.8 source builds compiled and installed successfully with the macOS 13.2 deployment target; the jobs failed only in the post-build assertion because llvm-config reports the valid versioned name libLLVM-21.dylib rather than libLLVM.dylib. Commit bd33edb updates both build/install assertions to accept LLVM versioned dylib names. Dry run 29536734503 is validating the corrected head and the downstream macOS wheel repair/tag checks.

[qciaran]

Full release dry run 29536734503 passed. Both native packages built and passed explicit platform-tag validation on manylinux 2.28 x86_64, macOS 13 arm64/x86_64, and Windows amd64. The pinned glibc 2.28 container successfully installed and imported both Linux wheels; ABI/runtime coverage passed across Python 3.10-3.14, including arm64 testing on macOS 14. quantum-pecos wheel/sdist generation and final artifact collection also passed. The PR description has been updated with these results.

[qciaran]

Independent cross-review found that the macosx_13_0 wheels still embedded LC_BUILD_VERSION minos 13.2, and that pecos-rslib-llvm lacked macOS/Windows runtime coverage. Commit f1b6565 addresses the findings: the deployment target is now genuinely 13.0; CI opens every macOS wheel and checks every packaged Mach-O minimum version with otool; the Python 3.10-3.14 matrix installs both native wheels and performs an LLVM assembly-to-bitcode smoke operation on every OS; the bundled LLVM 21.1.8 license is included and asserted at runtime; and trusted-branch, script-keyed LLVM archive caching reduces future release cost. Local pre-commit and a locally installed LLVM-wheel smoke test pass. A new full release dry run is being launched.