ci: pin manylinux_2_28 and explicitly select python3.12 interpreter

maturin-action@v1 with 'manylinux: auto' started failing with
'Couldn't find any python interpreters from python3' in the docker
build environment. Pin to manylinux_2_28 (AlmaLinux 8 based, current
upstream default) and explicitly request the cp312 interpreter, plus
symlink python3 onto PATH via before-script-linux so maturin's
interpreter probe succeeds.

Pre-existing issue; surfaced now because our new push/PR triggers
run the linux build on every commit, not just on release tags.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: affandar

.github/workflows/publish.yml

@@ -50,8 +50,11 @@ jobs:
         uses: PyO3/maturin-action@v1
         with:
           target: ${{ matrix.target }}
-          args: --release --out dist
-          manylinux: auto
+          args: --release --out dist --interpreter python3.12
+          manylinux: "2_28"
+          before-script-linux: |
+            # maturin_2_28 images expose pythons at /opt/python/*/bin but not on PATH
+            ln -sf /opt/python/cp312-cp312/bin/python3 /usr/local/bin/python3 || true
           sccache: "true"
       - uses: actions/upload-artifact@v4
         with: