mypy: add build-mypy.yml for riscv64 mypyc wheels

[luhenry]

What

Adds .github/workflows/build-mypy.yml to build riscv64 mypyc-compiled wheels for mypy 2.3.1 and publish them to pypi.riseproject.dev. mypy ships per-interpreter compiled wheels on PyPI for every platform except riscv64 (only the slow py3-none-any fallback is available there).

mypy is the canonical mypyc package — it compiles itself. This mirrors upstream's own wheel recipe from mypyc/mypy_mypyc-wheels's cibuildwheel.toml, with riscv64 overrides.

Shape

• build-from-checkout (like build-tomli.yml), matrix [cp312, cp313, cp314, cp314t] — mypyc emits per-interpreter (non-abi3) wheels.
• Unlike tomli, mypy already uses setuptools.build_meta, so there's no flit→setuptools backend swap and no host-side script — the job is just checkout → cibuildwheel → upload.
• mypyc is opt-in via MYPY_USE_MYPYC=1 (setup.py); without it the build silently ships a pure-Python wheel, so it's load-bearing. MYPYC_OPT_LEVEL=3 matches upstream's shipped wheels.
• No registry index needed — the two mypyc-specific deps (librt, ast-serialize) already ship public-PyPI riscv64 wheels; the rest are pure-Python.
• No auditwheel --exclude — the compiled wheel vendors nothing (librt stays a runtime pip dep).
• Full upstream test parity: installs test-requirements.txt, then runs mypy.test + mypyc.test (minus test_external) against the installed compiled wheel.

Validated before push

End-to-end on native aarch64 (cp312, manylinux_2_28), single-file -O3 — the config this PR ships:

• ✅ Wheel contains 231 .so (matches upstream exactly), 14.5 MB, zero vendored .libs/.
• ✅ All deps (librt 0.13.0, ast-serialize 0.6.0, lxml 6.1.0, psutil) resolved from public PyPI.
• ✅ CIBW_TEST_COMMAND plumbing runs pytest against the installed compiled wheel from a temp cwd — 1505 passed, 2 skipped, 3 xfailed, 0 failed on a testcheck+test_run slice.
• ✅ actionlint clean (only the expected ubuntu-24.04-riscv unknown-label warning).

Notes for reviewers

• Slow build: the mypyc mega-module compiles for ~40 min at -O3 even on fast native aarch64; the riscv runner is slower, so the build job carries timeout-minutes: 720 (repo precedent: torch's riscv job uses 1440). MYPYC_MULTI_FILE=1 was tested and is worse (sequential per-file compile, no -j), so single-file (upstream's Linux default) is kept.
• The publish job dry-runs off main, so it's safe on this PR branch.

🤖 Generated with Claude Code