fix(ci): use --without-pip venv + get-pip.py for stripped host Python

Host Python 3.13 lacks both pip and ensurepip modules, so python3 -m venv
fails. Create venv with --without-pip, then bootstrap pip via get-pip.py.