fix(dev): bootstrap pip in existing virtual environments

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ec5-7e2b-7743-ac08-719e1b0f42e2

Makefile

@@ -16,6 +16,7 @@ $(VENV)/bin/python:
 	python3 -m venv $(VENV)
 
 $(VENV)/.dev-installed: pyproject.toml $(VENV)/bin/python
+	@$(PIP) --version >/dev/null 2>&1 || $(PYTHON) -m ensurepip --upgrade
 	$(PIP) install --upgrade pip
 	$(PIP) install -e ".[dev]"
 	@touch $(VENV)/.dev-installed

workplans/ADHOC-2026-09-05.md

@@ -21,5 +21,25 @@ priority: low
 Applied Ruff import and formatting corrections to existing source/tests and
 shortened one docstring to clear the 44 repository lint failures. Corrected
 SCOPE.md's stale runtime-not-started entry. Full Ruff checks and the 88-test
-suite pass using the existing venv directly. Make bootstrap remains dependent
-on pip, which this workstation's existing venv does not contain.
+suite passed using the venv directly because pip was missing. The bootstrap
+repair below resolves that limitation.
+
+
+## Repair pip-less local verification bootstrap
+
+```task
+id: QONTO-WP-ADHOC-2026-09-05-T02
+status: done
+priority: low
+```
+
+Bootstrap pip through Python ensurepip when an existing venv lacks pip, then
+verify the standard make install-dev, test and lint commands.
+
+**Done:** Make now probes for pip and runs ensurepip only when needed. The
+existing pip-less venv was repaired successfully; make install-dev, make test
+(88 passed), and make lint all pass. A repeated install-dev does no extra work.
+
+Runtime handoff review confirms rapp-qonto owns packaging and rollout evidence;
+this repo's direct Kubernetes assets remain migration input. Production
+approval stays separate from the verified reef runtime.