ci(release): fix embedded wheel builds for Windows, macOS, and Linux aarch64

.github/workflows/release.yml

@@ -73,21 +73,28 @@ jobs:
             manylinux: manylinux_2_28
 
           # Linux aarch64 — AWS Graviton, Raspberry Pi, etc.
+          # Requires QEMU (set up below) for cross-compilation on the x86_64 runner.
           - os: ubuntu-latest
             target: aarch64
             manylinux: manylinux_2_28
 
           # macOS Apple Silicon (M1/M2/M3)
+          # Pin to Python 3.13: macos-latest ships Python 3.14 which PyO3 0.23.x
+          # does not yet support (max supported is 3.13).
           - os: macos-latest
             target: aarch64
+            python-version: "3.13"
 
-          # macOS Intel
-          - os: macos-13
+          # macOS Intel (macos-13 was retired December 2025; macos-15-intel is the
+          # current Intel label)
+          - os: macos-15-intel
             target: x86_64
+            python-version: "3.13"
 
           # Windows x86_64
           - os: windows-latest
             target: x86_64
+            python-version: "3.13"
 
     runs-on: ${{ matrix.os }}
     steps:
@@ -102,6 +109,21 @@ jobs:
       - name: Verify coordinode-rs submodule tag
         run: git -C coordinode-rs describe --tags --exact-match HEAD || true
 
+      # Pin Python on macOS and Windows: macos-latest ships Python 3.14 which
+      # PyO3 0.23.x does not yet support. Remove when PyO3 >= 0.24 is adopted.
+      # Linux builds run inside a manylinux container that manages Python itself.
+      - name: Set up Python ${{ matrix.python-version || '3.13' }}
+        if: runner.os != 'Linux'
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version: ${{ matrix.python-version || '3.13' }}
+
+      # QEMU is required for maturin-action to cross-compile Linux aarch64 wheels
+      # on the x86_64 ubuntu-latest runner using the manylinux container.
+      - name: Set up QEMU
+        if: runner.os == 'Linux' && matrix.target == 'aarch64'
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff9f9a89f41e8f8e6f3  # v3
+
       - name: Install protoc (macOS / Windows)
         if: runner.os != 'Linux'
         uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b  # v3.0.0