Pin pip tooling version in CI
Installs pip from a hash-pinned bootstrap file (.github/pip-bootstrap.txt, pip 26.2.2) before any other pip command in the jobs that run pip: the OCR runtime smoke job in ci.yml and the wheel build job in publish-pypi.yml.
The bootstrap file uses --require-hashes and --only-binary=:all:, so the pip upgrade itself is verified against the pinned wheel hash. Existing action pins are unchanged.
Verified in a python:3.12-slim container (pip 25.0.1): python -m pip install --no-cache-dir -r .github/pip-bootstrap.txt results in pip 26.2.2.
No image or deployment is affected; the change takes effect on the next workflow run.
Summary by cubic
Pins the pip version used in CI to pip 26.2.2 by installing it from a hash-pinned bootstrap file (.github/pip-bootstrap.txt) before any other pip command. The bootstrap uses --require-hashes and --only-binary=:all:, so the upgrade is verified against the pinned wheel hash.
The bootstrap step runs in the OCR runtime smoke job in ci.yml and the wheel build job in publish-pypi.yml. Existing action pins are unchanged, and the change takes effect on the next workflow run without affecting any image or deployment.