fix: pin manylinux2014 image for cp38 wheels

[Ramlaoui]

Summary

• pin the Linux manylinux2014 x86_64 container to the last known-good digest that still ships cp38
• make the Linux interpreter explicit in the manual wheels workflow so the matrix uses the intended CPython version
• keep non-Linux builds on the default maturin-action path

Root Cause

The release workflow was pulling quay.io/pypa/manylinux2014_x86_64:latest, and upstream removed cp38-cp38 from that mutable tag. The repo still requested /opt/python/cp38-cp38/bin/python, so the Linux 3.8 wheel job failed before publish/release.

Verification

• validated both workflow files parse as YAML
• reproduced that the current manylinux2014_x86_64:latest image no longer contains cp38-cp38
• reproduced that the pinned digest still contains /opt/python/cp38-cp38/bin/python