Upgrade releases to manylinux 2_28. (#14927)

We've been building with this in a downstream for a while. Newer
versions of tools that work better help.

Moving on this now because I hit #14926, which should be fixed, but
reminded me that this old version of manylinux/glibc is missing
performance improving API calls.

Once this lands, we can also switch the deploy script to use clang/lld.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e95e46e..97a5b1c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -537,10 +537,16 @@
       - cpu
       - os-family=Linux
     steps:
+      - name: Prefetch Docker
+        run: |
+          docker pull ghcr.io/nod-ai/manylinux_x86_64:main &
       - name: "Checking out repository"
         uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
         with:
           submodules: true
+      - name: Wait for docker pull
+        run: |
+          wait
       - name: Build runtime wheels (Linux)
         shell: bash
         env:
diff --git a/build_tools/docker/context/install_tbb_manylinux2014.sh b/build_tools/docker/context/install_tbb_manylinux2014.sh
deleted file mode 100755
index c227734..0000000
--- a/build_tools/docker/context/install_tbb_manylinux2014.sh
+++ /dev/null
@@ -1,50 +0,0 @@
-#!/bin/bash
-# Copyright 2021 The IREE Authors
-#
-# Licensed under the Apache License v2.0 with LLVM Exceptions.
-# See https://llvm.org/LICENSE.txt for license information.
-# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
-# The version of tbb installed on manylinux2014 is too old to support the
-# parallel STL libraries on the installed GCC9-based toolchain. Further,
-# Intel *broke* compatibility starting in 2021 for GCC<=10.
-# To make matters worse, the prior 2020 versions did not have cmake or
-# install support.
-# Shame on you Intel.
-# See: https://community.intel.com/t5/Intel-oneAPI-Threading-Building/tbb-task-has-not-been-declared/m-p/1254418
-# Since this is unlikely to be helpful outside of the old centos systems
-# that manylinux2014 is based on (newer ones are based on Debian),
-# we just tailor this specifically for docker images of that distro.
-
-# You can test this with either an official manylinux2014 docker image or
-# our special one (which is really only special in that it includes bazel):
-# docker run --rm -it -v $(pwd):/work stellaraccident/manylinux2014_x86_64-bazel-4.2.2:latest /bin/bash
-
-set -e
-
-mkdir -p /tmp/libtbb_build
-cd /tmp/libtbb_build
-curl -o tbbsrc.tgz -L https://github.com/oneapi-src/oneTBB/archive/refs/tags/v2020.3.tar.gz
-tar xzf tbbsrc.tgz
-cd oneTBB-*/
-
-echo "****** BUILDING TBB ******"
-make -j$(nproc)
-cp -R include/* /usr/include
-cp build/*_release/* /usr/lib64
-echo "prefix=/usr
-exec_prefix=${prefix}
-libdir=${exec_prefix}/lib64
-includedir=${prefix}/include
-
-Name: Threading Building Blocks
-Description: Intel's parallelism library for C++
-URL: http://www.threadingbuildingblocks.org/
-Version:
-Libs: -ltbb
-Cflags:
-" > /usr/lib64/pkgconfig/tbb.pc
-
-echo "****** DONE BUILDING TBB ******"
-
-cd /
-rm -Rf /tmp/libtbb_build
diff --git a/build_tools/docker/dockerfiles/manylinux2014_x86_64-release.Dockerfile b/build_tools/docker/dockerfiles/manylinux2014_x86_64-release.Dockerfile
deleted file mode 100644
index 63b1c3b..0000000
--- a/build_tools/docker/dockerfiles/manylinux2014_x86_64-release.Dockerfile
+++ /dev/null
@@ -1,69 +0,0 @@
-# Copyright 2022 The IREE Authors
-#
-# Licensed under the Apache License v2.0 with LLVM Exceptions.
-# See https://llvm.org/LICENSE.txt for license information.
-# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
-
-# This is derived from a stock manylinux2014 image, based on CentOS 7.
-# It does not derive from any of our other images and contains sufficient
-# software to build release packages for that OS. Note that the upstream
-# images are patched regularly with backports from RedHat and have relatively
-# recent dev tooling and Python versions. Bump the base hash to get Python
-# and dev tooling upgrades.
-#
-# This line of images is EOL on June 30, 2024. Prior to that, we should upgrade
-# to a newer revision. Newer manylinux images are based on Debian.
-#
-# Refer to: https://github.com/pypa/manylinux
-FROM quay.io/pypa/manylinux2014_x86_64@sha256:1818cd784995512fd6865baf79bd34c8f426f356a98fdc53495cf0bcd9e6b790
-
-SHELL ["/bin/bash", "-e", "-u", "-o", "pipefail", "-c"]
-
-USER root
-
-######## Pre-requisite packages ########
-RUN yum install -y \
-      java-11-openjdk-devel \
-      ccache \
-      capstone-devel libzstd-devel \
-  && yum clean all
-
-######## Bazel ########
-WORKDIR /install-bazel
-COPY build_tools/docker/context/install_bazel.sh .bazelversion ./
-RUN ./install_bazel.sh && rm -rf /install-bazel
-
-##############
-
-# See: https://github.com/bazelbuild/bazel/issues/10327
-# Note also that many things that link fine on newer OS's seem to fail based
-# on missing -lm, so just adding here.
-ENV BAZEL_LINKOPTS ""
-ENV BAZEL_LINKLIBS "-lstdc++ -lm"
-
-######## TBB ########
-# TBB is a dependency of Tracy and there is not a packaged source for a versoin
-# that is compatible with the STL shipped on this OS. So we use a script to
-# fetch/build/install exactly what is needed.
-COPY build_tools/docker/context/install_tbb_manylinux2014.sh /usr/local/bin
-RUN bash /usr/local/bin/install_tbb_manylinux2014.sh
-
-######## AMD ROCM #######
-ARG ROCM_VERSION=5.2.1
-ARG AMDGPU_VERSION=22.20.1
-
-# Install the ROCm rpms
-RUN  echo -e "[ROCm]\nname=ROCm\nbaseurl=https://repo.radeon.com/rocm/yum/${ROCM_VERSION}/main\nenabled=1\ngpgcheck=0" >> /etc/yum.repos.d/rocm.repo \
-  && echo -e "[amdgpu]\nname=amdgpu\nbaseurl=https://repo.radeon.com/amdgpu/${AMDGPU_VERSION}/rhel/7.9/main/x86_64\nenabled=1\ngpgcheck=0" >> /etc/yum.repos.d/amdgpu.repo \
-  && yum install -y rocm-dev \
-  && yum clean all
-
-
-######## GIT CONFIGURATION ########
-# Git started enforcing strict user checking, which thwarts version
-# configuration scripts in a docker image where the tree was checked
-# out by the host and mapped in. Disable the check.
-# See: https://github.com/openxla/iree/issues/12046
-# We use the wildcard option to disable the checks. This was added
-# in git 2.35.3
-RUN git config --global --add safe.directory '*'
diff --git a/build_tools/docker/manage_images.py b/build_tools/docker/manage_images.py
index fbc7b28..25801e7 100755
--- a/build_tools/docker/manage_images.py
+++ b/build_tools/docker/manage_images.py
@@ -45,7 +45,6 @@
 IMAGES_TO_DEPENDENCIES = {
     "base": [],
     "base-arm64": [],
-    "manylinux2014_x86_64-release": [],
     "android": ["base"],
     "emscripten": ["base"],
     "nvidia": ["base"],
diff --git a/build_tools/docker/prod_digests.txt b/build_tools/docker/prod_digests.txt
index 788e36a..4049999 100644
--- a/build_tools/docker/prod_digests.txt
+++ b/build_tools/docker/prod_digests.txt
@@ -9,7 +9,6 @@
 gcr.io/iree-oss/nvidia@sha256:4e814f5f3bac53c88b64f0fe89af9f3dcc43bcf8610ea8b4511e21015ad1fb9c
 gcr.io/iree-oss/emscripten@sha256:6e412f7ca51439ffce051a8a2e8fcbd7398743f461930a5f51c089441ffc3588
 gcr.io/iree-oss/android@sha256:d349a3d137d0ed0f7360af16096db682da0233679cdbb00a326150149e3c4fa4
-gcr.io/iree-oss/manylinux2014_x86_64-release@sha256:e83893d35be4ce3558c989e9d5ccc4ff88d058bc3e74a83181059cc76e2cf1f8
 gcr.io/iree-oss/shark@sha256:2b2e41dbf909194b598e226144a2fb1e74d31851d41fe519d0fcb6d071b77461
 gcr.io/iree-oss/base-bleeding-edge@sha256:14200dacca3a0f3a66f8aa87c6f64729b83a2eeb403b689c24204074ad157418
 gcr.io/iree-oss/swiftshader-bleeding-edge@sha256:d2483ac643184a16942489d8f709ef3714543ae795fa9ae8fd2e4d8bf68a24a0
diff --git a/build_tools/python_deploy/build_linux_packages.sh b/build_tools/python_deploy/build_linux_packages.sh
index f7161a8..9d02d4e 100755
--- a/build_tools/python_deploy/build_linux_packages.sh
+++ b/build_tools/python_deploy/build_linux_packages.sh
@@ -64,7 +64,7 @@
 this_dir="$(cd $(dirname $0) && pwd)"
 script_name="$(basename $0)"
 repo_root=$(cd "${this_dir}" && find_git_dir_parent)
-manylinux_docker_image="${manylinux_docker_image:-$(uname -m | awk '{print ($1 == "aarch64") ? "quay.io/pypa/manylinux_2_28_aarch64" : "gcr.io/iree-oss/manylinux2014_x86_64-release@sha256:e83893d35be4ce3558c989e9d5ccc4ff88d058bc3e74a83181059cc76e2cf1f8" }')}"
+manylinux_docker_image="${manylinux_docker_image:-$(uname -m | awk '{print ($1 == "aarch64") ? "quay.io/pypa/manylinux_2_28_aarch64" : "ghcr.io/nod-ai/manylinux_x86_64:main" }')}"
 python_versions="${override_python_versions:-cp39-cp39 cp310-cp310 cp311-cp311}"
 output_dir="${output_dir:-${this_dir}/wheelhouse}"
 packages="${packages:-iree-runtime iree-compiler}"
@@ -200,7 +200,7 @@
     yum install -y capstone-devel tbb-devel libzstd-devel
   elif [[ "$uname_m" == "x86_64" ]]; then
     # Check if the output is x86_64
-    echo "The architecture is x86_64 so assume we are on older manylinux2014 with TBB deps installed in the image"
+    echo "The architecture is x86_64 so assume we are on a managed image with deps"
   else
     echo "The architecture is unknown. Exiting"
     exit 1