ci: decouple the wheel's macOS support floor from the runner image (build protobuf/absl from source) #20

Follow-up to #18, which was fixed by #19 with option (b) — pinning the wheel-building
runners to macos-15. This is option (c), the durable fix.

Problem

The published wheel's macOS support floor is currently a function of the runner image,
because the bundled protobuf/abseil come from Homebrew bottles built for whatever macOS
the runner happens to be. delocate then refuses to bundle dylibs whose min target is
newer than the wheel's, so the two must be kept equal by hand.

That coupling is the actual defect. #18 was one instance of it: GitHub rolled
macos-latest to macOS 26, the bottles moved to a 26.0 min target, and the pinned 15.0
wheel target stopped matching. Pinning to macos-15 fixes the instance and leaves the
coupling in place — the same break recurs whenever we move the pin, and it forces a
choice between "stay on an aging runner" and "raise the support floor," which are
unrelated concerns that shouldn't be welded together.

macos-15 will itself be deprecated, so this has a deadline, just not an urgent one.

Proposed fix

Build protobuf/abseil from source on macOS at the chosen deployment target, rather than
taking Homebrew bottles — which is what the Linux leg already does, and for a closely
related reason. See scripts/cibw_install_protobuf_linux.sh (invoked via
CIBW_BEFORE_ALL_LINUX) for the existing pattern; the macOS equivalent would replace
CIBW_BEFORE_ALL_MACOS: brew install protobuf in both ci.yml and publish.yml.

This makes the support floor an explicit, declared choice, independent of the runner
image, and lets the runner go back to macos-latest.

Cost: slower macOS legs (source build instead of a bottle), and a second build script to
maintain. Worth weighing against how often the coupling bites — twice now, if you count
the macos-13 deprecation noted in publish.yml's matrix comment.

Done-when

• macOS wheel legs no longer depend on Homebrew bottles for protobuf/abseil
• MACOSX_DEPLOYMENT_TARGET is settable without regard to the runner image, and a
  comment says so
• wheel-building runners can return to macos-latest in both ci.yml and publish.yml
• a green macOS wheel build on a runner whose OS is newer than the deployment target
  — the exact case that broke in ci: macOS wheel build broken — macos-latest moved to macOS 26, MACOSX_DEPLOYMENT_TARGET pinned to 15.0 #18

Not urgent

#19 restored green and the support floor is unchanged. This is the fix that stops it
recurring, not one that unblocks anything today.