chore(ci): add prebuilt z3 release pipeline

[drew]

Summary

Replace source-built Z3 in release packaging with prebuilt static artifacts published to a rolling z3-latest GitHub release.

Related Issue

• Linear: OS-54 https://linear.app/nvidia/issue/OS-54/prebuilt-z3-release-pipeline-for-cli-and-wheel-builds
• Parent roadmap: OS-43 https://linear.app/nvidia/issue/OS-43/openshell-policy-prover-opp-roadmap

Changes

• Added a manual release-z3.yml workflow that builds static Z3 bundles for Linux musl, Linux gnu, and macOS arm64 and publishes them to z3-latest
• Added shared Z3 packaging/download helper scripts and a dedicated macOS Z3 Docker build
• Updated CLI and Python wheel release packaging to download prebuilt Z3 artifacts instead of building with bundled-z3
• Documented the new release-build flow in architecture/build-containers.md

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)
• Ran sh -n tasks/scripts/z3/common.sh tasks/scripts/z3/build-artifact.sh tasks/scripts/z3/download-release-artifact.sh
• Ran git diff --check on the touched files
• mise run pre-commit failed in the existing test:rust step

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-816.docs.buildwithfern.com/openshell