ci: fix Forgejo Python workflows for node:20-bookworm runner

ubuntu-latest maps to docker://node:20-bookworm with python3 but no pip.
Install python3-pip via apt (reuse-surface pattern), use short-SHA archive
checkout, and --break-system-packages for PEP 668. Unblocks CUST-WP-0059 T05.

.forgejo/workflows/publish-python-package.yml

@@ -1,3 +1,6 @@
+# Publish kaizen-agentic to Forgejo org PyPI on version tags.
+# Runner substrate: ubuntu-latest → node:20-bookworm — install pip via apt.
+# Org secrets required: FORGEJO_PYPI_USER, FORGEJO_PYPI_TOKEN.
 name: Publish Python package
 
 on:
@@ -16,13 +19,17 @@ jobs:
         run: |
           set -eu
           mkdir -p buildctx
+          SHORT="${REF:0:7}"
           wget -qO /tmp/repo.tar.gz \
-            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
+            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz"
           tar xzf /tmp/repo.tar.gz -C buildctx --strip-components=1
 
-      - name: Set up Python
+      - name: Install Python tooling
         run: |
-          python3 -m pip install --upgrade pip build twine
+          set -eu
+          apt-get update -qq
+          apt-get install -y -qq python3 python3-pip python3-venv >/dev/null
+          python3 -m pip install --break-system-packages --upgrade pip build twine
 
       - name: Build and validate distributions
         working-directory: buildctx