ci: run Python checks in Bookworm container

.gitea/workflows/ci.yml

@@ -9,31 +9,34 @@ on:
 jobs:
   python:
     runs-on: gitea-cicd-server-for-CODEX
+    container: node:22-bookworm
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
 
-      # The runner job image only has Debian's Python 3.9 without ensurepip,
-      # while the project requires Python 3.10 or newer. Use the Actions tool
-      # cache rather than depending on the retired Debian 11 package mirrors.
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-
-      - name: Check Python
-        run: python --version
+      # The runner label defaults to node:16-bullseye, whose Python 3.9 is too
+      # old and whose Debian repositories are retired. A Bookworm job image
+      # keeps Node available for JavaScript actions and provides Python 3.11.
+      - name: Set up Python
+        run: |
+          set -eu
+          apt-get update -qq
+          apt-get install -y -qq python3-venv
+          python3 --version
+          python3 -m venv .venv
+          .venv/bin/python -m pip install --quiet --upgrade pip
 
       - name: Install
-        run: python -m pip install --quiet -e ".[dev]"
+        run: .venv/bin/python -m pip install --quiet -e ".[dev]"
 
       - name: Lint
-        run: python -m ruff check .
+        run: .venv/bin/python -m ruff check .
 
       - name: Test
-        run: python -m pytest -q
+        run: .venv/bin/python -m pytest -q
 
       - name: Check the CLI entry point
         run: |
           set -eu
-          lean-bench --help > /dev/null
-          lean-bench doctor --skip-llm --env /dev/null
+          .venv/bin/lean-bench --help > /dev/null
+          .venv/bin/lean-bench doctor --skip-llm --env /dev/null