Add workflow building manylinux_2_28 wheels

[pmrv]

Summary

Adds a Build wheels GitHub Actions workflow so cluster deployments can pip install a prebuilt wheel instead of compiling the C++ extensions on every machine.

• Builds x86_64 wheels for CPython 3.9–3.13 with cibuildwheel in the manylinux_2_28 image (glibc ≥ 2.28, so RHEL/Rocky 8+, Ubuntu 20.04+ and similar).
• Runs on version tags and on workflow_dispatch; also on PRs that touch the workflow file itself.
• Smoke-tests that every compiled module imports from the repaired wheel outside the source tree.
• Uploads wheels and sdist as run artifacts, and on a tag attaches them to the GitHub Release.
• Checkout uses full history and tags so versioneer produces a real version.
• Install docs mention the release wheels.

Notes

• A wheel built outside the manylinux container ends up tagged manylinux_2_39 (verified with auditwheel show on a local build), which is why this has to go through cibuildwheel rather than a plain python -m build.
• The extensions only link against libc, libm, libstdc++ and libgcc, so auditwheel repair has nothing to vendor.
• lib/maxvolpy is not covered: it's a separate package and its setup.py hard-codes -march=native, so a portable wheel for it needs a small patch first.

🤖 Generated with Claude Code

https://claude.ai/code/session_0165n5fATQ2icKWKHQXY6XEo

---

Generated by Claude Code

[pmrv]

CI status on bdb8733: all five wheel jobs, the sdist job and the existing test matrix are green.

The one check that is not is Build and publish Python distributions to TestPyPI, which has been sitting in "queued" for an hour. That workflow (publish-to-test-pypi.yml) runs on every push and targets ubuntu-18.04, a runner label GitHub retired, so it never gets picked up and each run is auto-cancelled after 24 h. The run on master's own head (3ef779f, run ICAMS#33) is stuck the same way, so this is pre-existing and not caused by this PR. Not touching it here since it's a publishing pipeline and outside this change's scope; deleting the workflow or moving it to ubuntu-latest with a tag-only trigger would clear it.

---

Generated by Claude Code