Make Python release wheels reproducible

[bordumb]

What changed

• Derive Maturin's SOURCE_DATE_EPOCH from the exact Git commit timestamp.
• Build the maintained Python wheel twice during normal bindings/compliance CI and require byte-identical SHA-256 digests before install testing.
• Fail closed when the commit timestamp is missing, malformed, or outside the ZIP timestamp domain.
• Advance and regenerate the frozen release-control identity.
• Document the deterministic wheel contract and the authoritative cross-runner comparison.

Root cause

Release preparation run #5 completed both isolated builders, then rejected the candidate because the Python wheel differed between them.

Maturin uses SOURCE_DATE_EPOCH for wheel metadata timestamps. Auths did not set it, so separate runners packaged the same source with different ZIP timestamps. The release comparator correctly treated that as a terminal platform-reproducible mismatch.

Evidence

• Two wheel builds from final commit 807daa398c8e9353784855322eca28e7b49d49ed, using its commit-derived epoch, produced the same SHA-256:
  • d4b9c709389e0a545b48b29ccca5cf9c683293d385cfa83899d8d637c944652a
  • d4b9c709389e0a545b48b29ccca5cf9c683293d385cfa83899d8d637c944652a
• All 43 xtask unit tests passed.
• Semantic freeze passed with 42 entries and 28 public Rust packages.
• Formatting and diff whitespace checks passed.
• The broader local bindings command passed Rust, WASM, and TypeScript checks, but this Mac's global npm cache stopped npm pack before Python with a pre-existing root-owned cache-file error. The two Python wheel builds were therefore run directly and passed byte comparison.

Affected claims

• Same-platform Python wheels for one exact commit are byte reproducible.
• Normal premerge bindings/compliance CI rejects wheel nondeterminism before release preparation.
• The isolated release comparison remains authoritative across hosted runners.

Exclusions and remaining gates

• No tag, prerelease, registry package, or release artifact is published.
• The failed candidate preparation remains rejected and must not be promoted.
• Pull-request CI must pass, then a new preparation must run against the new merged-main commit.