#204 Pin pip tooling version in CI

Installs pip from a hash-pinned bootstrap file (.github/pip-bootstrap.txt, pip 26.2.2, --require-hashes and --only-binary=:all:) before the first pip command in:

• ci.yml Python bindings job (before pip install maturin)
• release.yml wheel build job on non-Linux runners (Linux builds run inside the maturin container)
• release.yml PyPI dry-run check, which previously used pipx run twine check: it now sets up Python, bootstraps pip, installs twine and runs python -m twine check

The wheel test jobs install with --no-index from local artifacts and make no network requests, so they are unchanged.

Verified in a python:3.13-slim container: the bootstrap file yields pip 26.2.2 and python -m twine --version runs afterwards. No image or deployment is affected; the change takes effect on the next workflow run.

---

Summary by cubic

Pins CI pip to a hash-verified bootstrap file (.github/pip-bootstrap.txt, pip 26.2.2 with --require-hashes and --only-binary=:all:) so every pip invocation runs on a known-good version.

• Bootstraps pip before pip install maturin in the CI Python bindings job.
• Bootstraps pip on non-Linux release wheel build runners; Linux builds run inside the maturin container and are unaffected.
• The PyPI dry-run check now bootstraps pip, installs twine, and runs python -m twine check instead of pipx run twine check, gaining checkout and Python setup steps for manual runs.
• Wheel test jobs stay unchanged because they install from local artifacts with --no-index and make no network requests.