ci: build manylinux 2.28 Python wheels

[dcfocus]

Summary

• Fixes Publish wheels for common downstream platform baselines #63 by building release wheels for manylinux_2_28 x86_64, manylinux_2_28 aarch64, and macosx_11_0 arm64, with README documentation for the supported wheel matrix.
• Fixes Make graph/Cypher dependencies optional for core context storage #64 by moving the Python lance-graph package out of the default install and into the optional graph extra: pip install "lance-context[graph]".
• Uses PyO3/maturin-action for release and PR wheel builds, then publishes once from the collected artifacts.
• Installs a current protoc binary inside the manylinux_2_28 build containers to avoid the old system protoc failure on --experimental_allow_proto3_optional.

Uber onboarding context

• Default exported Python requirements no longer include lance-graph, so core context storage/retrieval avoids the Python graph package's native wheel constraint.
• Release wheels now target the downstream baselines requested for lockfile-based environments: manylinux_2_28_x86_64, manylinux_2_28_aarch64, and macosx_11_0_arm64.
• Existing source distributions remain available as the fallback for other platforms.

Testing

• ruby -e 'require "yaml"; ARGV.each { |path| YAML.load_file(path); puts "ok #{path}" }' .github/workflows/python-publish.yml .github/workflows/python-test.yml
• git diff --check
• uv lock --check
• uv export --no-dev --no-hashes --format requirements-txt (verified default requirements exclude lance-graph)
• uv run python -c metadata check for graph extra
• uv run pytest python/tests/ -q (3 passed)
• uv run pytest tests/ -q (83 passed, 2 skipped, 6 failed locally in existing compaction/direct-Lance-read/moto-S3 paths)

Fixes #63
Fixes #64