feat: allow opt-in for new backends

[b-long]

⚠️ work-in-progress ⚠️

To-do List (imperfect / likely to change)

• Setup machinery for opting into new backends
• Setup CI test coverage, so that we can exercise the new backends
• Start with cffi backend
• Close the cffi gaps and drop the skip list (see "Notes: cffi" below).
• Start the pybind11 backend (see "Notes: pybind11" below).

Notes: cffi

• Work through the 6 skipped tests, in order of difficulty:
  • []byte ↔ bytes, natively through cffi.
  • Makefile and pkg mode support.
  • Complex numbers.
  • Go calling back into Python callbacks, which is the hardest. It needs cffi callbacks, and the GIL and thread handling get tricky.
• Result: cffi passes the full suite. Then we can widen CI to the full 24-job matrix and remove the skip list.

Notes: pybind11

• The existing Go shim already calls the CPython C API. So pybind11 (or nanobind) only needs to replace the generated C code, meaning the same recorder approach that emits C++ instead of a cffi module. That should be less work than cffi was, because the Go side stays as it is.
• It needs a C++ compiler and the pybind11 package on all three operating systems, so CI setup is a bit heavier. There are open questions about the ABI and versioning, pybind11 and nanobind differ in Python version support.
• Result: three comparable backends, but not yet measured.