fix(python): use ensurepip for reliable pip installation on Windows

[CalvinAllen]

Summary

• Replace get-pip.py with ensurepip --default-pip --upgrade as primary pip installation method
• Reorder Install() to configure pip before creating shims
• Add fallback to get-pip.py for edge cases
• Add unit tests for enableSitePackages and shim configuration

Problem

Windows Python installations from two different sources had pip issues:

Source	Issue
python.org embeddable	pip not included at all
python-build-standalone	pip module works, but pip.exe has broken embedded build paths

Users installing Python 3.14.2 on Windows saw "Failed to install pip" warnings (issue #201).

Solution

Use python -m ensurepip --default-pip --upgrade which:

• Works on both distribution types
• Creates working pip.exe, pip3.exe, pipX.Y.exe executables
• Generates scripts with correct paths (since it runs post-installation)
• Falls back to get-pip.py if ensurepip fails

Changes

src/runtimes/python/provider.go

• Reordered install flow: pip → shims (so executables exist before shims are created)
• New installPip() using ensurepip as primary method
• New installPipWithGetPip() as fallback
• enableSitePackages() now best-effort (ignores missing ._pth files)

src/runtimes/python/provider_test.go

• Added TestPythonProvider_EnableSitePackages (4 test cases)
• Added TestPythonProvider_Shims (verifies pip/pip3 shims configured)

Test plan

• Unit tests pass (go test ./runtimes/python/...)
• All tests pass (go test ./...)
• Linter passes (golangci-lint run ./...)
• Integration test with Python 3.14.2 on Windows (PR pending in .github repo)

Fixes #201