Refine release wheel and validation workflows

[gouyt13]

Summary

• Build and test CPython 3.11 and 3.14 wheels on PRs for Linux, Windows, and macOS; build all four supported ABIs in parallel for releases. Keep the existing required wheel check names and cancel superseded PR release runs.
• Split clang-tidy across two runners while retaining the required C++ static analysis check. Run portable Linux Release C++ tests before the installed CMake consumer test, without installing GoogleTest into the package prefix.
• Set read-only token permissions for the non-release workflows; documentation deployment retains its write permission.

Testing

• Parsed the edited workflow YAML and checked the ABI selection, artifact names, required gates, and publish dependencies.
• Ran both clang-tidy shards against a CI-style compilation database; verified they cover every selected translation unit exactly once.
• Built and ran the portable Release C++ suite: 187/187 tests passed. Installed the package and passed the downstream CMake consumer test (1/1); confirmed the install contains no GoogleTest files.
• shellcheck scripts/check-tidy.sh
• /home/yutong/micromamba/envs/rabitq/bin/python -m unittest discover -s .github/scripts -p 'test_*.py' (22 passed)
• git diff --check

GitHub Actions has not run this branch yet. The effect on CI wall time and runner minutes needs to be measured in the PR run.