ci: fix Forgejo publish workflow for node:20-bookworm runner

Install python3-pip via apt so twine publish works on the default
ubuntu-latest container image (same substrate fix as kaizen-agentic).

.forgejo/workflows/publish-python-package.yml

@@ -1,3 +1,6 @@
+# Publish issue-core to Forgejo org PyPI on version tags.
+# Runner substrate: ubuntu-latest → node:20-bookworm — install pip via apt.
+# Org secrets required: FORGEJO_PYPI_USER, FORGEJO_PYPI_TOKEN.
 name: Publish Python package
 
 on:
@@ -16,13 +19,17 @@ jobs:
         run: |
           set -eu
           mkdir -p buildctx
+          SHORT="${REF:0:7}"
           wget -qO /tmp/repo.tar.gz \
-            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
+            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz"
           tar xzf /tmp/repo.tar.gz -C buildctx --strip-components=1
 
-      - name: Set up Python
+      - name: Install Python tooling
         run: |
-          python3 -m pip install --upgrade pip build twine
+          set -eu
+          apt-get update -qq
+          apt-get install -y -qq python3 python3-pip python3-venv >/dev/null
+          python3 -m pip install --break-system-packages --upgrade pip build twine
 
       - name: Build and validate distributions
         working-directory: buildctx
@@ -38,4 +45,4 @@ jobs:
         run: >-
           python3 -m twine upload
           --repository-url https://forgejo.coulomb.social/api/packages/coulomb/pypi
-          dist/*
+          dist/*