ci: modernize Tests & Publish via cibuildwheel (Python 3.11–3.14)

[philomath213]

Summary

Modernize the Tests and Publish CI so they build, test, and ship on the current GitHub runner images and cover Python 3.11–3.14.

The macOS/Windows failures on the newer runners came from their default CMake 4.x rejecting the vendored protobuf/json's pre-3.5 cmake_minimum_required (plus a latent Windows protobuf-install bug), not from the dependencies themselves. This keeps those deps as-is and lets the runners' built-in CMake accept them via CMAKE_POLICY_VERSION_MINIMUM=3.5.

Changes

• build(deps): bump Microsoft SEAL to v4.3.3, vendors zlib 1.3.2, fixing the macOS-15-SDK zlib fdopen clash.
• ci: Tests via cibuildwheel on ubuntu-24.04 / windows-2022 / macos-14: build cp311–cp314, run the test suite on the latest (cp314) only.
• ci: align publish_wheels.yml to the same recipe (cp311–cp314), so shipped wheels are produced exactly like the tested ones.
• fix(protobuf): explicit --config Release for the Windows build/install (newer CMake rejects an empty --config).
• ci: Bazel workflow → workflow_dispatch only, it's broken and fixed separately; this stops it reding every PR.
• chore: bump version to 0.3.17

Notes

• macOS is arm64-only (macos-14); the retired macos-13 Intel target is dropped.
• Linting stays on Python 3.13.
• No dependency rewrites: protobuf and nlohmann/json are unchanged.

Next steps (follow-ups, not in this PR)

• Lint on Python 3.14: the Linter stays on 3.13 here because the pinned black==22.3.0 can't run on 3.14 (it crashes on asyncio.get_event_loop()). Bumping to a 3.14-compatible black also reformats ~17 files, so do it as its own PR (bump black + reformat + update pyproject.toml target-version).
• Fix the Bazel build: currently workflow_dispatch-only. Restore it in a dedicated PR; its deps.bzl/BUILD files still pin the old SEAL and -std=c++17.
• Retire the CMake policy shim: CMAKE_POLICY_VERSION_MINIMUM=3.5 is a transitional escape hatch for the old protobuf/json floors. The durable fix is moving to a newer protobuf (which needs a FetchContent-targets integration), after which the shim can be dropped.
• Track runner-image EOL: this pins windows-2022, macos-14, and Xcode 15.4. When those retire, the deferred toolchain modernization applies (e.g., xtensor 0.27 + C++20 to build under AppleClang 17 on macos-15).