Publish wheels to halide/pypi instead of pypi.halide-lang.org

[alexreinking]

Summary

• Replaces twine upload to pypi.halide-lang.org with gh release create/upload against halide/pypi, tagged halide-llvm@<version>.
• The check job now looks for existing wheel filenames among halide/pypi's halide-llvm@* release assets instead of scraping the old PyPI simple-index HTML page (same substring-match logic, different source).
• Adds a manifest.json sidecar (filename -> sha256) to each release so the generated index can include integrity hashes without downloading multi-hundred-MB wheels just to hash them.
• Explicitly triggers halide/pypi's rebuild-index.yml after publishing (no implicit webhook — see that repo's README for why).

Why

pypi.halide-lang.org is hosted on an MIT-operated OpenStack VM that turned out to be subject to intermittent, unpredictable border-security IP quarantines (confirmed via MIT CSAIL InfoSec: shared Azure/GitHub-Actions egress IPs occasionally get quarantined for unrelated scanning activity from other tenants, and MIT has no exception mechanism). Measured ~10% of CI runs hitting this over a 3-week audit. halide/pypi moves both the index and the actual files onto GitHub's own infrastructure (Releases + Pages), which CI already trusts and depends on.

Test plan

• Validated the identical publish/rebuild pattern end-to-end on halide/halide-wheel-deps (a smaller, fully-controlled repo) before writing this PR: releases created correctly, manifest.json hashes correct, generated index verified from the actual Pages artifact, explicit dispatch trigger confirmed working.
• Not yet run for real on this repo (LLVM builds are slow/expensive) — recommend a manual workflow_dispatch run on this branch against a cheap ref before merging, to confirm the full 8-platform matrix + version-tag extraction works for actual halide-llvm wheels rather than just the smaller test package's wheels.
• pypi.halide-lang.org DNS still points at the old MIT server (NameCheap cutover not yet done), so this only writes to halide/pypi for now -- no production traffic is affected until DNS is switched over.