Package verified FFTW dependencies outside Git

[galenlynch]

OpenEphysFFTW currently commits platform binaries directly to libs/. Those binaries use different FFTW versions, and the macOS library requires macOS 14.6 although the project advertises 10.15.

This first of two PRs adds a reproducible release pipeline for FFTW 3.3.11 bundles on:

• Ubuntu 24.04 x86-64
• Windows Server 2025 x86-64
• macOS 26 universal x86-64/Arm64, with a minimum deployment target of macOS 11

Each bundle contains the double- and single-precision libraries, headers, linker files, FFTW license, conda-forge recipe license, source archive, and provenance metadata. Normal plugin builds still use the checked-in binaries; a follow-up PR will consume the released bundles and remove those files.

Packaging contract

The packaging script verifies pinned conda-forge inputs before extracting them. It repackages complete, non-threaded FFTW shared libraries without rebuilding, reducing, or stripping their symbols. Long-double, MPI, OpenMP, and threaded variants remain out of scope.

A C smoke test links and executes both fftw_* and fftwf_* transforms. CI also checks the macOS architectures and deployment target.

The workflow and third-party notices document the binary sources and licenses. FFTW remains licensed under GPL-2.0-or-later; the included conda-forge recipe scripts use BSD-3-Clause.

Release procedure

After merging this PR, a maintainer should:

1. Enable GitHub release immutability for the repository.
2. Tag the reviewed merge commit as fftw-dependencies-3.3.11-1 and push the tag.
3. Confirm that all three packaging jobs pass.
4. Inspect and publish the draft release created by the workflow.

Publishing makes the tag and assets immutable and creates GitHub’s release attestation. If a bundle is wrong, publish a new revision such as fftw-dependencies-3.3.11-2; do not replace a published asset.

CI maintenance

This PR also moves CI to current hosted runners and action releases, pins actions by commit, and enables Dependabot updates for GitHub Actions.

Verification

The three-platform packaging matrix passed in workflow run 34284226831. The macOS bundle contains both architectures and both precisions, each with a minimum deployment target of macOS 11.

[galenlynch]

The original PR description proposed publishing immutable FFTW dependency releases and consuming them through a second PR. This branch no longer uses that design.

The revised implementation keeps the hash-pinned conda-forge inputs but stages them during ordinary CMake configuration:

• The first configure downloads and verifies the package for the current platform.
• CMake extracts double- and single-precision libraries under the ignored libs/generated/<platform> directory.
• Later configurations reuse that local stage without network access.
• FFTW_ROOT bypasses preparation for clean offline builds and read-only source trees.
• A process lock, completeness checks, and a preparation-script digest prevent concurrent, partial, or stale stages.
• FFTW's license, source provenance, and conda-forge recipe accompany installed and packaged runtime files.

The checked-in FFTW binaries, dependency-specific workflow, immutable-release procedure, and proposed consumption PR have therefore been removed. The existing Linux, Windows, and macOS workflows exercise dependency preparation through the same CMake path used by local builds.

On Linux, I verified a clean online configuration, immediate cache reuse, linked double- and single-precision smoke tests, and a separate offline build using FFTW_ROOT.