fix: use build venv in Gitea publish workflow (PEP 668)

Haskelseed runner blocks system-wide pip installs. Create an isolated
.build-venv for build/twine and document workflow_dispatch API path.

.gitea/workflows/publish-python-package.yml

@@ -26,11 +26,11 @@ jobs:
           TWINE_PASSWORD: ${{ secrets.PACKAGE_TOKEN }}
         run: |
           cd repo
-          python3 -m ensurepip --upgrade 2>/dev/null || \
-            curl -sS https://bootstrap.pypa.io/get-pip.py -o /tmp/get-pip.py && python3 /tmp/get-pip.py
-          python3 -m pip install --upgrade pip build twine
-          python3 -m build
-          python3 -m twine check dist/*
-          python3 -m twine upload \
+          python3 -m venv .build-venv
+          . .build-venv/bin/activate
+          python -m pip install --upgrade pip build twine
+          python -m build
+          python -m twine check dist/*
+          python -m twine upload \
             --repository-url https://gitea.coulomb.social/api/packages/coulomb/pypi \
             dist/*