Migrate CI and python bindings to nanobind 3.x

[harrism]

CI pins nanobind at 2.5.0 on every platform (ci/install_nanobind.sh on Linux/macOS; #2317 extended the same pin to Windows after the vcpkg baseline rolled to 3.0.0). The pin is a lease, not a fix: nanobind 3.x is where upstream development happens, and the next forced upgrade (vcpkg, distro, or a needed 3.x feature) should be deliberate rather than a CI surprise.

Known 3.x issues to address when migrating:

• nanobind 3.0 headers trip nvcc front-end diagnostics (Update Travis to add ABI=5 support #177 unused variable, Fix OpenEXR VDB Render issue on Windows #550 set-but-unused in nb_func.h) and host-compiler attribute warnings (nb_backend.h, nb_error.h), which --Werror=all-warnings turns into build failures in the CUDA binding TUs. Options: an upstream fix (the diagnostics look like trivial header hygiene), nanobind's NB_SUPPRESS_WARNINGS module flag, or system-include exemption — noting that nvcc with an MSVC host confers no system-header status via -isystem, so Windows needs one of the first two.
• Audit the bindings against 3.x API changes (the 2.x-pinned build has never compiled against 3.x).

Related: #2317 (the Windows pin), #1916 (nanobind introduction).