Improve plugin safety, source releases, and CI checks

[gijzelaerr]

Summary

• Allocate scratch audio channels for all enabled plugin buses during warm-up, audio processing, and MIDI rendering. This addresses the out-of-bounds channel access reported in Segmentation fault (usually) when loading Spectrasonics VST3 plugins #346.
• Skip parameter probing when load_plugin() receives no initial parameter values, addressing the load-time hangs reported in load_plugin() parameter sweep floods The Usual Suspects instruments with SysEx and makes them hang #513. Add a regression test and make the editor subprocess use the active Python interpreter.
• Switch the public pybind11 submodule to HTTPS. Build, check, and publish a source distribution alongside release wheels, with a CI smoke build from that archive. This addresses the installation path in No source tarballs on PyPI #478.
• Require Python lint, type checking, and C++ formatting jobs to pass. Update contributor and installation instructions and replace obsolete tox checks with the commands used in CI.

Local validation

• Native editable build succeeded.
• Source archive built with JUCE, pybind11, and Rubber Band included; a wheel built from that archive.
• Full test suite: 26,922 passed, 4 skipped.
• Pyright: 0 errors; Ruff lint and format: passed; C++ formatting and git diff --check: passed.
• Workflow YAML parsed successfully.

Follow-up

The multi-bus crash was not reproduced locally because the affected third-party instruments are not in the test fixtures. #346 and #513 should stay open until their reporters verify the change. The Debian-specific build report in #462 also needs validation on Debian.

Related open PRs

The HTTPS submodule change matches #429 and #479. The contributor-documentation changes overlap #497 and parts of #502; the tooling changes also touch work proposed in #503. These should be reconciled during review so the existing contributors' work is accounted for.

[gijzelaerr]

Superseded by focused draft PRs #515 (plugin safety), #516 (source distribution), and #517 (CI and contributor tooling).