COMP: Move ITK Python wrapping to SWIG 4.4.1

[hjmjohnson]

Move ITK Python wrapping to SWIG 4.4.1. Fixes the import regression in #6479; supersedes the temporary #6480 (4.3.x baseline) and #6481 (WIP CI).

Three focused commits, no WIP — standard GHA + Azure CI run on this PR. The Azure/ARM Python pipelines exercise the vendored 4.4.1 binaries; local pixi run build-python uses conda-forge SWIG/CastXML.

What changed

• Multi-phase init fix. ITK packs several SWIG modules per shared library and injects C that calls PyInit__<X>Python() and stores the return in sys.modules. SWIG 4.4 (PEP 489 multi-phase init) makes PyInit_* return a raw PyModuleDef, so the proxy failed at import with 'moduledef' object has no attribute 'delete_SwigPyIterator'. The injection now detects a returned def at runtime and instantiates it via PyModule_FromDefAndSpec + PyModule_ExecDef; the single-phase (≤4.3) path is unchanged; all APIs are Limited-API-safe (≥3.5).
• abi3 floor. Pinned to a single cached source of truth _ITK_MINIMUM_SUPPORTED_LIMITED_API_VERSION (3.11), shared by the Limited-API auto-detect and USE_SABI. 3.11+ build abi3 and load on 3.11; 3.10 keeps the non-Limited-API path.
• Vendored SWIG 4.4.1 via FetchContent + version assertion. The prebuilt-binary download moves from ExternalProject_Add to FetchContent, so SWIG_EXECUTABLE exists at configure time and itk_assert_swig_version() confirms it reports ≥ swig_version_min (now 4.3.0; too-old system swig is a FATAL_ERROR). Binaries are repackaged from the official, broadly-portable SWIG PyPI wheels and hosted on data.kitware.com (resolved by SHA512). Source-build fallback stays on ExternalProject.
• Local dev. configure-python / configure-debug-python pass ITK_USE_SYSTEM_SWIG/ITK_USE_SYSTEM_CASTXML; swig (>=4.4.1) + castxml added to the python pixi feature.

How the vendored binaries were produced (reproducible)

The swig<os>-<arch>-4.4.1.zip archives are repackaged from the official swig PyPI package (https://pypi.org/project/swig/, maintained by the SWIG team, built with cibuildwheel). These wheels are the broadest-portability prebuilt SWIG available — Linux manylinux2010 (glibc 2.12) / manylinux2014, macOS 10.9 universal2 (x86_64+arm64 in one file), and Windows — far more portable than building on a dev box. Each wheel contains swig/data/bin/swig[.exe] + swig/data/share/swig/4.4.1/, i.e. ITK's exact layout, so repackaging is just extract-and-rezip (platform-independent — no cross-compiling):

process() {  # $1=pip-platform-tag  $2=itk-archive-name
  wd=$(mktemp -d)
  pip download --no-deps swig==4.4.1 --platform "$1" --only-binary=:all: -d "$wd"
  ( cd "$wd" && unzip -q swig-4.4.1*.whl )
  chmod +x "$wd/swig/data/bin/"*
  ( cd "$wd/swig/data" && zip -r -q "$OLDPWD/$2.zip" bin share )   # bin/ + share/ at archive root
}
process macosx_10_9_universal2   swigmacos-arm64-4.4.1   # universal2 also serves swigmacos-amd64
process manylinux2010_x86_64     swiglinux-amd64-4.4.1
process manylinux2014_aarch64    swiglinux-arm64-4.4.1
process win_amd64                swigwin-amd64-4.4.1

The resulting archives were uploaded to data.kitware.com and are fetched by SHA512:

archive	wheel source	SHA512
swigmacos-arm64 / -amd64	macosx_10_9_universal2	17c4637d…1ce3cef9
swiglinux-amd64	manylinux2010_x86_64	6447a7b9…d88ca11
swiglinux-arm64	manylinux2014_aarch64	44a6d174…c8902d24
swigwin-amd64	win_amd64	700bd4de…e338f3892

itk_assert_swig_version() runs swig -version on the downloaded binary at configure time and fails if it is not ≥ swig_version_min, so a wrong/corrupt upload is caught immediately. For a future SWIG bump, rerun the recipe with the new version, re-upload, and update ITK_SWIG_VERSION + the per-platform SHA512s.

Validation

Builds and imports on Python 3.11.15 and 3.13.9 (same abi3 build); the std::vector/SwigPyIterator path and 10/10 scoped Python ctests pass. The vendored FetchContent download from data.kitware.com was verified at configure time to fetch 4.4.1, pass the assertion, and build _ITKCommonPython.abi3.so cleanly.

Download mirrors

data.kitware.com (keyed by SHA512) is the primary; dweb.link, ipfs.io, and gateway.pinata.cloud serve the same bytes by content id as IPFS fallbacks, matching ITK's ExternalData gateway set. URL_HASH SHA512 validates whichever mirror responds. The content ids are the reproducible ipfs-car/IPIP-0499 CIDs produced by the ExternalData upload pipeline:

archive	CID
swigwin-amd64	bafybeifxjnbydus4eq46bocwb2hcj5ufpbj4etocia5ims426gfiw7krfi
swiglinux-amd64	bafybeiep2wbecrcii7xzfe2cekhfco6mlxqym4jhfdl6xi3p4aieblgz6m
swiglinux-arm64	bafybeifaqaus3yzp5oujxupxk422hfmcg2idf3oyvdtsppzq7ymn64nvze
swigmacos-arm64/amd64	bafybeidllsbllkqwoby6r5w4ueqzky2o7r6qkjbh45q57mczyh2fwfwd3q

The archives are pinned to IPFS and mirrored into ITKTestingData via the ExternalData upload pipeline.

[hjmjohnson]

Pushed a fix for the vendored-SWIG Python CI failure (ARMBUILD-Python / ITK.*.Python): the FetchContent refactor removed the swig ExternalProject target, but the wrapping build-ordered against it whenever ITK_USE_SYSTEM_SWIG=OFF. Now guarded with if(NOT ITK_USE_SYSTEM_SWIG AND TARGET swig) — prebuilt binaries are fetched at configure time and need no build-order dependency. Verified locally: the vendored path downloads SWIG 4.4.1 from data.kitware.com, passes the configure-time version assertion, and builds _ITKCommonPython.abi3.so cleanly.