fix(ci): use venv to bypass PEP 668 on shell executor

Shell executor host Python 3.13 (Debian) enforces PEP 668, blocking
system-wide pip. Create and activate a venv in before_script for all
jobs that need Python packages. Cache .venv/ for faster reruns.