ci(release-readiness): static abi3 audit on every wheel

## Purpose

The wheel is built `cp310-abi3`, promising it uses only CPython's stable
ABI (PEP 384) and works on any CPython 3.10+. If a Rust dependency or
PyO3 macro accidentally pulls in a non-stable-ABI symbol, the wheel
imports fine on the Python it was built against but breaks at runtime on
other 3.x versions. This catches that before a release.

## Solution

Added an `abi3audit` step to every leg of `cross-platform-build`,
running immediately after `Validate wheel built`. Uses `python -m abi3audit
--strict --report dist/*.whl` with the `--strict` flag so any non-stable-
ABI symbol is a hard failure. Uses `python` (not `python3`) for Windows
compatibility. Runs unconditionally on all 7 build targets since
abi3audit reads any wheel format (ELF/Mach-O/PE) regardless of the host OS.

## Follow-ups

Manual trigger required to verify all 7 legs pass (CI-0025 step 6):
`gh workflow run "Release Readiness" --ref main --field skip_integration=true`

Author: jhamon

.github/workflows/release-readiness.yml

@@ -399,6 +399,19 @@ jobs:
             exit 1
           fi
 
+      # abi3audit parses the compiled extension inside the wheel and flags any CPython
+      # symbols that aren't part of the stable ABI (PEP 384). A cp310-abi3-tagged wheel
+      # that pulls in a non-stable-ABI symbol imports fine on the build Python but breaks
+      # at runtime on other 3.x versions. This is the static complement to multi-python
+      # smoke tests: the smoke tests exercise the wheel; abi3audit proves it is valid by
+      # inspection. Runs on every OS and reads any wheel format (ELF/Mach-O/PE).
+      - name: abi3audit
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m pip install --quiet abi3audit
+          python -m abi3audit --strict --report dist/*.whl
+
       # auditwheel show inspects ELF binaries inside each manylinux wheel and reports
       # the actual minimum glibc version. A wheel tagged manylinux_2_17 but linking
       # newer symbols would silently break users on older systems; this catches that