fix: avoid unsafe host ISA selection in build arch detection

[kgeg401]

Summary

• make AUTO_DETECT_ARCH a real CMake option (default ON)
• ensure explicit ENABLE_* architecture flags always override auto-detection
• change x86 auto-detection to prefer host-safe -march=native for native builds
• add cibuildwheel per-arch overrides to force conservative manylinux targets:
  • x86_64: -DAUTO_DETECT_ARCH=OFF -DENABLE_HASWELL=ON
  • aarch64: -DAUTO_DETECT_ARCH=OFF -DENABLE_ARMV8A=ON

Why

Current x86 auto-detection chooses the highest compiler-supported ISA, which can emit instructions unavailable on target machines and cause SIGILL.

Validation

• static review of CMake arch-selection flow
• validated pyproject.toml edits and cibuildwheel override structure
• note: local environment lacks a usable C/C++ compiler toolchain, so compile/test verification is deferred to CI

Fixes #92

[CLAassistant]

All committers have signed the CLA.