[damaestro]

Summary

Repairs the failing Build Wheels, Build Docker and Publish source workflows. It also updates the GitHub Actions they use. Publishing steps now run only on the upstream repo's master, and only after tests pass. Forks still build and test everything.

Fixes

• Windows wheel builds failed with Cannot open include file: 'Eigen/Core'. libs/cnmatrix/CMakeLists.txt ran an unchecked git clone of Eigen. The clone is now shallow and retried, falls back to a release tarball, and stops with a clear error if Eigen is still missing. The Windows wheel job also installs Eigen through vcpkg.
• Builds failed in repos without git tags (forks, shallow checkouts), because git describe aborted setup.py and the workflows. setup.py, publish-source.yml and cmake.yml now fall back to 0.0.0.. Tagged builds produce the same versions as before.
• Docker push was refused with installation not allowed to Create organization package. The job now has packages: write, and the image is only pushed from upstream master.
• Wheel artifacts were never uploaded, because the path pointed outside the checkout. They now upload dist/*.whl with a per-matrix artifact name.
• build_nuget.yml had a stray tab that made the YAML invalid.
• publish-source.yml used the retired ubuntu-20.04 runner and the deprecated ::set-output. It now uses ubuntu-latest and $GITHUB_OUTPUT.

Action updates

Updated every action to its latest release.

Publishing is gated

• PyPI: each wheel gets an install-and-import smoke test, run with --no-deps. The upload is a separate publish job that needs every matrix leg and only runs on collabora/libsurvive at master.
• Release assets: cmake.yml uploads from a release job that needs all build and test jobs. publish-source.yml first requires a successful "Build and Test" run for the same commit.
• Docker: the image is always built, and pushed only from upstream master.
• Fork builds: these jobs no longer touch the registry or PyPI.