ci: harden Python environment bootstrap

.gitea/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: Validators (Pull Requests Only)
+name: Validators (Pushes and Pull Requests)
 
 on:
   pull_request:
@@ -41,14 +41,18 @@ jobs:
         if [ ! -f "$VENV/bin/python" ]; then
           echo "=== venv 신규 생성: $REQ_HASH ==="
           mkdir -p "$VENV_BASE"
-          /usr/bin/python3 -m venv "$VENV"
+          /usr/bin/python3 --version
+          /usr/bin/python3 -m venv "$VENV" || {
+            echo "venv creation failed; attempting ensurepip recovery"
+            /usr/bin/python3 -m ensurepip --upgrade
+            /usr/bin/python3 -m venv "$VENV"
+          }
 
-          # venv 내 pip 확인 및 복구
+          # The runner may provide a venv without pip. Bootstrap with the
+          # active interpreter instead of a version-specific get-pip URL.
           if [ ! -f "$VENV/bin/pip" ]; then
-            echo "pip missing in venv, installing via get-pip.py..."
-            curl -sS https://bootstrap.pypa.io/pip/3.8/get-pip.py -o get-pip.py
-            "$VENV/bin/python" get-pip.py --quiet
-            rm get-pip.py
+            echo "pip missing in venv, bootstrapping with ensurepip..."
+            "$VENV/bin/python" -m ensurepip --upgrade
           fi
 
           "$VENV/bin/pip" install --upgrade pip --quiet