should this be sourced as an external library from somewhere (github release tarball?) so we don't need to have a parallel build of the library maintained here?

It can be used as a build-time CMake dependency via scikit-build, but this requires changing the package build to use scikit-build - that could be an avenue.

Otherwise, there is an open JAX PR that ports some existing pybind11 code to nanobind - there they have a leaner build file, but still explicit configs (I think that is sensible too tbh)

In the end, however, we are pulling straight from github in Bazel too, so this might already be what you intended? (The build file is necessary to mark it as a Bazel dep)

i thought similar to how we depend on googletest, we could depend on nanobind. but maybe it's a different type of dependency if we don't directly link to it? or maybe nanobind doesn't support bazel directly?

Exactly, nanobind only supports CMake. So I'm afraid we need the full build file setup regardless. But at least the link above shows that it can still be simplified, especially if we don't particularly care about pinning the submodules.