Build and publish native macOS wheels

[marco-mariotti]

Summary

• build CPython 3.12 and 3.13 wheels on native Intel and Apple Silicon macOS runners, alongside the existing manylinux targets
• split wheel, sdist, and publish work so PyPI receives one verified artifact set
• add an explicit non-publishing workflow mode and verify all eight wheels plus the sdist before publishing
• replace retired macOS CI runner labels
• synchronize the Python and Cargo versions at 0.2.7 and document the release-version policy

Why

PyPI currently has only Linux wheels for ruranges, so macOS installation falls back to compiling the Rust extension from source. The prior release workflow was Linux-only and coupled building with publishing, which made adding a platform matrix unsafe because independent jobs could publish partial artifact sets.

Validation

• actionlint .github/workflows/CI.yml .github/workflows/build_and_publish.yml

• cargo check --all-features

• built ruranges-0.2.7-cp313-cp313-macosx_11_0_arm64.whl locally with maturin

• installed that wheel in a clean virtual environment and exercised ruranges.numpy.merge

• built ruranges-0.2.7.tar.gz locally

• dry-run workflow 31703460709 built, smoke-tested, and verified eight wheels plus one sdist; PyPI publishing was skipped

• the full PR CI matrix passes on the final branch head, including native macos-15-intel and macos-15 jobs