ci: isolate test backend install in venv

The persistent Gitea runner caches the setup-python toolcache between
runs. A previous run that produced wheels with broken metadata (no
Version field in METADATA) left a notify-bridge-server install with
no RECORD file in site-packages. The next run hits:

  Found existing installation: notify-bridge-server None
  error: uninstall-no-record-file

pip refuses to uninstall (no RECORD) and refuses to overlay (it tries
to uninstall first). Switching from a system-pip install into the
toolcache to an isolated /tmp/venv per run sidesteps the leak — each
CI run starts with empty site-packages.

Same change to build.yml and release.yml so the pre-merge gate and
the release-gate both run the same setup.

.gitea/workflows/release.yml

@@ -20,17 +20,20 @@ jobs:
         with:
           python-version: "3.12"
 
-      # Same wheel-first strategy as build.yml — editable install is too slow
-      # on the hosted runner.
-      - name: Build wheels
+      # Wheel-first strategy in an isolated venv — editable install is too slow,
+      # and a plain pip install into the toolcache Python leaks state across
+      # runs on the persistent Gitea runner (previous broken wheel installs
+      # leave dist-info dirs that pip can't uninstall: "uninstall-no-record-file").
+      - name: Build wheels in isolated venv
         run: |
-          python -m pip install --upgrade pip build
+          python -m venv /tmp/venv
+          /tmp/venv/bin/pip install --upgrade pip build
           mkdir -p /tmp/wheels
-          pip wheel --no-deps -w /tmp/wheels packages/core packages/server
+          /tmp/venv/bin/pip wheel --no-deps -w /tmp/wheels packages/core packages/server
 
       - name: Install backend + test deps
         run: |
-          pip install /tmp/wheels/*.whl pytest pytest-asyncio httpx aioresponses prometheus_client
+          /tmp/venv/bin/pip install /tmp/wheels/*.whl pytest pytest-asyncio httpx aioresponses prometheus_client
 
       - name: Run pytest
         env:
@@ -40,7 +43,7 @@ jobs:
           NOTIFY_BRIDGE_CORS_ALLOWED_ORIGINS: "http://localhost:8420"
         run: |
           cd packages/server
-          pytest tests --tb=short
+          /tmp/venv/bin/pytest tests --tb=short
 
   release:
     needs: [test-backend]