manifest: add python + node tool registrations (closes #931, #932, #933, #944)

[zackees]

Part of #930 bootstrap meta. First wave of asset registrations on the manifest branch — addresses the four cleanest sub-issues (no producer infrastructure needed, just pointer manifests against well-hosted upstreams).

Summary

Adds two new tool entries to the manifest branch, following the existing cargo-zigbuild/manifest.json pointer-manifest pattern:

Tool	Upstream	Asset shape	Sub-issues
python	astral-sh/python-build-standalone	install_only tarball for all 8 canonical triples	#931, #932, #933
node	nodejs/node (nodejs.org/dist)	win-<arch>/node.lib + headers tarball	#944

Files changed

• python/manifest.json — cpython 3.13.14 (release tag 20260610), 8 platforms, each with sha256-verified URL pointing at github.com/astral-sh/python-build-standalone/releases.
• node/manifest.json — Node v22.23.0, 3 Windows arches (x64/arm64/x86), each with sha256-verified URL pointing at nodejs.org/dist + the platform-agnostic headers tarball.
• manifest.json — registers python and node in the top-level tools map.
• asset-index.json — appends 12 new flat entries (8 Python + 3 Node libs + 1 Node headers).

Why pointer manifests (not mirrored binaries)

• python-build-standalone publishes ~853 assets per release on github.com — well-CDN'd, stable URLs, sha256 sums published. Mirroring would add ~660 MB to this branch.
• nodejs.org/dist has been the canonical Node distribution for 15+ years; stable URLs, SHASUMS256.txt sidecar.
• Pattern matches cargo-zigbuild/manifest.json which already does the same (URLs point at github.com/rust-cross/cargo-zigbuild/releases).
• If upstream reliability becomes an issue, mirroring is a future, additive PR — no migration needed.

SHA256 provenance

Python hashes pulled from https://github.com/astral-sh/python-build-standalone/releases/download/20260610/SHA256SUMS. Node hashes pulled from https://nodejs.org/dist/v22.23.0/SHASUMS256.txt. Sizes are the raw content-length from a HEAD against each URL.

What this PR does NOT do

• Does not modify .github/scripts/build_manifest.py on main. That script currently knows only about GitHub-Releases-shaped tools; teaching it about python-build-standalone and nodejs.org/dist is a follow-up PR against main. Until that lands, these entries are hand-maintained on this branch — but the file shapes are wire-compatible with what the script produces for the other tools, so a future merge is straightforward.
• Does not wire soldr-CLI consumption. Soldr's prepare, cargo-front-door PYO3 auto-set, and soldr env subcommand are tracked in bootstrap: new soldr env --target <triple> subcommand (export SDKROOT, PYO3_CROSS_*) #938/bootstrap: auto-set PYO3_CROSS_* when cargo front door detects PyO3 in workspace #939/etc. and need code changes against main. This PR just stages the assets so those consumers have something to fetch.
• Does not cover OpenSSL (bootstrap: bundle OpenSSL Windows MSVC libs (x64 + arm64) #943), vcpkg (bootstrap: vcpkg x64-windows-static-md triplet bundle #945/bootstrap: vcpkg arm64-windows-static-md triplet bundle #946), or libLLVM (bootstrap: install llvm-tools-preview so rust-objcopy can strip cross-compiled binaries #934) — those need different producer paths (slproweb extraction, Windows CI runner, rustup component install). Filed separately.

Verification

python3 -c "
import json
d = json.load(open('python/manifest.json'))
print('platforms:', sorted(d[0]['platforms'].keys()))
"
# → ['darwin-arm64', 'darwin-x64', 'linux-arm64-gnu', 'linux-arm64-musl',
#    'linux-x64-gnu', 'linux-x64-musl', 'windows-arm64-msvc', 'windows-x64-msvc']

Schema-equivalent to cargo-zigbuild/manifest.json — same top-level keys (tool, owner, repo, tag, version, name, draft, prerelease, created_at, published_at, release_html_url, platforms, assets).

Test plan

• CI on the manifest branch (if any — most checks are on main).
• Spot-check: curl -fsSLI <one of the URLs from python/manifest.json> returns the expected Content-Length matching the manifest's size field.
• Verify top-level manifest.json schema_version is still 5 (no breaking change).

🤖 Generated with Claude Code