[hardbyte]

The macos-14 runner retires on November 2, 2026, which would block the ARM64 wheel job and tag releases that depend on it. Move that matrix entry to the supported ARM64 macos-15 runner and explicitly retain the published macOS 11.0 deployment baseline.

Add ARM64 CI checks for each wheel's filename and WHEEL metadata, native architecture and Mach-O minimum OS version. Install the Python 3.11 and 3.14t wheels in separate empty environments, exercise evaluation and the CLI, and verify that importing CEL on 3.14t leaves the GIL disabled. The other platform jobs and release steps are unchanged.

Validation on final commit c281ac862bad711910c99a97279a664720a6cf93:

• Local: actionlint 1.7.12, YAML parsing, embedded shell/Python syntax, and git diff --check passed. Compared parsed workflows to verify that non-macOS jobs are unchanged.
• ARM64 job passed on macos-15-arm64. Built CPython 3.11, 3.12, 3.13, 3.14 and 3.14t wheels; all five have macosx_11_0_arm64 filename/metadata tags and ARM64 extensions with Mach-O minos=11.0. Wheel artifact.
• Clean installs, isolated imports/evaluation, CLI evaluation and --version passed under CPython 3.11.9 and 3.14.10t. The 3.14t check verified a free-threaded interpreter and that importing CEL leaves the GIL disabled.
• Existing Python 3.11–3.14 and 3.14t test jobs, quality checks, macOS x86_64, both Windows jobs and sdist passed. Python 3.11 and 3.14t each reported 568 passed, 3 skipped and 5 xfailed.
• Full CI reached terminal failure after one retry: the unmodified Linux x86 manylinux job failed before compilation because vault.centos.org could not resolve while installing libatomic. Retry failure log. The other five Linux jobs were cancelled by matrix fail-fast on both attempts. No Linux workaround is included in this runner migration.

Limitations: macOS 11 runtime execution is not covered; wheel tags and binary deployment targets were checked on macOS 15. CPython 3.12–3.14 normal wheels were built and inspected, but clean-install smoke tests cover 3.11 and 3.14t. The tag-only release job was skipped on the PR. No tag, release, approval or merge was performed.

References: runner retirement, supported runner architectures, existing ARM64 wheel tags.