Publish and validate source distributions

[gijzelaerr]

Summary

• Use HTTPS for the public pybind11 submodule, so source checkouts do not require a GitHub SSH key.
• Build and publish a source distribution alongside release wheels.
• Verify that the source archive includes JUCE, pybind11, and Rubber Band, then compile a wheel from it in CI.
• Reduce build backend logging from DEBUG to INFO.

This addresses the source-install path in #478. The HTTPS submodule change is identical to #429 and #479; those contributions should be reconciled during review.

Validation

• Built the source archive locally and confirmed the bundled sources are present.
• Compiled a wheel from that archive.
• Native build, full test suite, lint, format, and type checks passed locally.

The Debian-specific report in #462 still needs validation on Debian.