fix(ci): use venv for ruff install — pipx not on runner image

The py3.12-node22 runner doesn't ship pipx, so the previous commit's
pipx install ruff failed with command not found. Switched to the same
venv pattern the test job uses.

.forgejo/workflows/ci.yml

@@ -76,12 +76,15 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Install ruff
-        # pipx keeps ruff isolated instead of polluting the system
-        # site-packages (the old --break-system-packages was a smell).
-        run: pipx install ruff
+        # Isolated venv avoids polluting the runner's system
+        # site-packages (the old --break-system-packages was a smell)
+        # and pipx isn't available on the py3.12-node22 runner image.
+        run: |
+          python3.12 -m venv /opt/ruff-venv
+          /opt/ruff-venv/bin/pip install --quiet ruff
 
       - name: Lint
-        run: ruff check src/
+        run: /opt/ruff-venv/bin/ruff check src/
 
   test:
     name: Python tests