feat(python-sdk): pure-Python bootstrap on PyPI fetches native wheels from GH Releases

[ZhiXiao-Lin]

Closes the gap left by #44, which moved native wheels off PyPI but broke `pip install a3s-code` for everyone except cp310 macOS arm64.

What this PR does

Adds a tiny pure-Python package (also named `a3s-code`) that goes to PyPI. On first `import a3s_code` it:

1. Resolves the matching native wheel name for the current interpreter + platform.
2. Downloads it from `https://github.com/AI45Lab/Code/releases/download/v/`.
3. Fetches `python-native-manifest.json` from the same release and verifies the wheel's sha256.
4. Extracts the compiled `_native..{so,pyd}` to `~/.cache/a3s-code//` (or `$XDG_CACHE_HOME/a3s-code//`, or `$A3S_CODE_CACHE_DIR//`).
5. Registers it as `sys.modules["a3s_code._native"]` via `importlib.machinery.ExtensionFileLoader` so `from ._native import *` in the package `init` works.

Subsequent imports skip the download.

```bash
pip install a3s-code # downloads the bootstrap (tiny)
python -c 'import a3s_code' # first call: fetches native wheel from GH Release (~17 MB)
python -c 'import a3s_code' # second call: uses cache, instant
```

Layout

```
sdk/python-bootstrap/
├── pyproject.toml # setuptools, pure-Python, no deps
├── README.md
├── src/a3s_code/
│ ├── init.py # bootstrap() then from ._native import *
│ ├── _bootstrap.py # loader logic
│ └── py.typed
└── tests/test_bootstrap.py # 15 unit tests + 1 live test
```

Env knobs

Variable	Effect
`A3S_CODE_CACHE_DIR`	Cache root (defaults to `$XDG_CACHE_HOME/a3s-code` or `~/.cache/a3s-code`)
`A3S_CODE_RELEASES_BASE_URL`	Override release base URL (air-gapped mirrors)
`A3S_CODE_SKIP_HASH_CHECK`	`1` skips sha256 verification (CI only)

Workflow integration

• New `publish-python-bootstrap.yml` — runs bootstrap unit tests, builds wheel + sdist, twine check, twine upload on tag push.
• `release.yml` wires it in after `publish-python` (which produces the GH Release the bootstrap points at). `github-release` job now waits on both.
• `scripts/check_release_versions.sh` validates the bootstrap's pyproject.toml version AND the runtime `version` literal — they must equal the core version so the bootstrap points at the right GH Release tag.
• `release.sh` bumps both in lockstep.

Test plan

• 15 unit tests pass (`python -m unittest tests.test_bootstrap`).
• Live download test passes against the real v3.2.0 GH Release wheels (`A3S_CODE_BOOTSTRAP_LIVE=1`).
• End-to-end: built the wheel locally, pip-installed into a fresh venv, ran `import a3s_code` with `version` temporarily patched to `3.2.0` (since the GH Release for 3.2.1 doesn't exist yet). Bootstrap downloaded the cp312 macOS arm64 wheel, extracted `_native.cpython-312-darwin.so` into the cache, registered it, and `a3s_code.Agent.create()` succeeded.
• `scripts/check_release_versions.sh` reports consistent at 3.2.1.
• `cargo test -p a3s-code-core --lib`: 1661 passed (unaffected).
• `cargo fmt --all` clean.

Bumps

Core / Node SDK / Python SDK 3.2.0 → 3.2.1.

Release sequence after this PR merges

1. Merge this PR to main.
2. Tag `v3.2.1`, push.
3. release.yml fires:
   • crates.io: `a3s-code-core 3.2.1`
   • npm: `@a3s-lab/code 3.2.1` + platform packages
   • GH Release v3.2.1: 12 native wheels + python-native-manifest.json
   • PyPI: `a3s-code 3.2.1` (the bootstrap, ~6 KB pure-Python wheel + sdist)
   • GH Release page with auto-generated notes

Optional follow-ups

• Yank the half-published `a3s-code 3.2.0` on PyPI (only ships cp310 macOS arm64). After 3.2.1 lands, 3.2.0 just confuses pip resolvers.
• The unused `PYPI_NATIVE_TOKEN` token from PR ci(publish-python): drop PyPI wheel push, GH Release becomes canonical #44's note is still needed — it's the same token the bootstrap publish reuses.