[envpool] stabilize manylinux release wheel builds

[Trinkle23897]

Why/Context/Summary

• Fix the new manylinux_2_28_x86_64 release path so the Release PyPI Wheel matrix can build wheels for Python 3.11, 3.12, and 3.13 again.
• The failure surface has moved several times while exercising the real release lane, so this PR now carries the minimal release-only fixes needed to keep the matrix moving forward:
  • remove typed-ast from make auditwheel-install for CPython 3.13
  • install the Perl Compress::Zlib dependency needed by NASM on manylinux
  • correct NASM feature detection for stdbit.h and strlcpy
  • provide a CPU-only CUDA stub for release builds that do not have a real CUDA toolkit
  • force SDL2/OpenCV CMake installs to use lib/ instead of lib64/ so rules_foreign_cc can find the expected static archives
• Keep the changes scoped to the release lane and release-time third-party build glue; no runtime env logic changes are intended here.

Test plan

• local: make auditwheel-install
• GitHub Actions: watch PR Release PyPI Wheel matrix on every commit (pull_request trigger enabled in this branch)
• current loop: keep fixing deterministic release blockers until the full 3.11/3.12/3.13 wheel matrix succeeds, then validate the generated wheels on dev