ci: parallelize wheel builds in CI

[pimlock]

Summary

• split wheel builds to match the CLI release layout with a Linux matrix job, separate macOS job, and a staging job
• build Linux wheels natively on matching runners instead of using the old Docker/buildx multiarch path
• cache native Linux wheel builds to offset the bundled Z3 compile cost

Related Issue

• Linear: OS-80 https://linear.app/nvidia/issue/OS-80/parallelize-wheel-ci-and-remove-docker-from-linux-wheel-builds

Changes

• update release-dev.yml and release-tag.yml to run Linux wheel builds as amd64 and arm64 matrix legs, keep macOS separate, and merge wheel artifacts in stage-python-wheels
• add Rust target and registry caching to the native Linux wheel jobs, matching the CLI build pattern
• simplify tasks/python.toml to keep native host wheel builds and explicit native Linux per-arch tasks
• remove the unused local tasks/publish.toml flow that depended on the retired Linux multiarch wheel task
• document the new wheel build shape in architecture/build-containers.md
• merge the latest main after fix(sandbox): harden seccomp denylist, SSRF protection, and inference policy enforcement #819 landed to pick up the unrelated Rust test fix

Testing

• Manual release-dev workflow dispatch on this branch: https://github.com/NVIDIA/OpenShell/actions/runs/24360271176
  Linux wheel jobs succeeded before the run was manually cancelled.
• Additional branch-tip validation without the temporary patchelf workaround: https://github.com/NVIDIA/OpenShell/actions/runs/24362100824
  Linux wheel jobs started successfully on the updated branch; the run was manually cancelled before completion.

Checklist

• Tests added or existing tests cover the change
• Documentation updated if behavior changed
• No secrets or credentials added

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-820.docs.buildwithfern.com/openshell