ci: install editable packages inside a venv

The hosted Gitea runner image pre-installs older versions of both packages
in its system Python site-packages and retains stale ~otify_bridge_core /
~otify_bridge_server dist-info directories from prior interrupted runs.
``pip install -e`` against the system interpreter tries to uninstall those,
the rollback fires mid-transaction, and the runner's
``/opt/hostedtoolcache/.../bin/notify-bridge`` console script disappears
before the new install can be placed:

  ERROR: Could not install packages due to an OSError:
  [Errno 2] No such file or directory:
  '/opt/hostedtoolcache/Python/3.12.12/x64/bin/notify-bridge'

Installing into a fresh venv sidesteps the pre-cached state entirely (and
is the recommendation pip itself prints on every run).

.gitea/workflows/build.yml

@@ -18,14 +18,17 @@ jobs:
         with:
           python-version: "3.12"
 
-      - name: Install core + server + dev deps
+      - name: Install core + server + dev deps (in venv)
         run: |
+          python -m venv .venv
+          . .venv/bin/activate
           python -m pip install --upgrade pip
           python -m pip install -e ./packages/core
           python -m pip install -e "./packages/server[dev]"
 
       - name: Run pytest (server)
         run: |
+          . .venv/bin/activate
           cd packages/server
           pytest -q --maxfail=1
 

.gitea/workflows/release.yml

@@ -17,8 +17,10 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
-      - name: Install + test
+      - name: Install + test (in venv, isolated from hosted tool cache)
         run: |
+          python -m venv .venv
+          . .venv/bin/activate
           python -m pip install --upgrade pip
           python -m pip install -e ./packages/core
           python -m pip install -e "./packages/server[dev]"
@@ -59,7 +61,6 @@ jobs:
 
       - name: Build and push Docker image
         uses: docker/build-push-action@v5
-        id: docker_build
         with:
           context: .
           push: true