feat(ci): add pypi publish workflow and add macos debug script

scripts/ci/github-ensure-macos-x86-64-homebrew.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Ensure an x86_64 (Rosetta) Homebrew exists at /usr/local/bin/brew.
+# GitHub-hosted Apple Silicon runners ship /opt/homebrew only; cx_Freeze universal
+# x64 slices need x86_64 libraries from /usr/local (see codec2, libyaml steps).
+set -euo pipefail
+
+if [[ "$(uname -s)" != "Darwin" ]]; then
+    exit 0
+fi
+
+if [[ -x /usr/local/bin/brew ]]; then
+    exit 0
+fi
+
+echo "github-ensure-macos-x86-64-homebrew: installing Homebrew under Rosetta into /usr/local (one-time on this runner)" >&2
+export NONINTERACTIVE=1
+export HOMEBREW_NO_ANALYTICS=1
+export HOMEBREW_NO_AUTO_UPDATE=1
+arch -x86_64 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+test -x /usr/local/bin/brew

scripts/ci/github-slsa-hashes-dist.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Emit base64-encoded sha256sum lines for files in ./dist (SLSA generic generator input).
+# Excludes *.cosign.bundle. Writes "hashes=<base64>" to GITHUB_OUTPUT when set.
+set -euo pipefail
+
+cd "$(dirname "$0")/../.."
+if [ ! -d dist ]; then
+    echo "dist/ missing" >&2
+    exit 1
+fi
+
+tmp="$(mktemp)"
+trap 'rm -f "$tmp"' EXIT
+
+(
+    cd dist
+    find . -maxdepth 1 -type f ! -name '*.cosign.bundle' -printf '%P\0' | sort -z | xargs -0 sha256sum
+) >"$tmp"
+
+if [ ! -s "$tmp" ]; then
+    echo "No files to hash under dist/" >&2
+    exit 1
+fi
+
+b64="$(base64 -w0 <"$tmp")"
+if [ -n "${GITHUB_OUTPUT:-}" ]; then
+    echo "hashes=${b64}" >>"$GITHUB_OUTPUT"
+else
+    printf '%s\n' "$b64"
+fi