ci: publish with a pip that excludes the compromised eMudhra/emSign CA

The publish job ran on Python 3.10, whose bundled pip still trusts the
compromised eMudhra/emSign root. Build and upload on Python 3.13, whose
latest patch bundles pip 26.2.2+, and fail the job if pip is older.

Signed-off-by: mday-io <mdaytn@gmail.com>

Author: mday-io

.github/workflows/release.yaml

@@ -40,9 +40,13 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.10'
+          # 3.13.17+ bundles pip 26.2.2+, which no longer trusts the compromised eMudhra/emSign root CA.
+          python-version: '3.13'
       - name: Install uv
         uses: astral-sh/setup-uv@v7
+      - name: Check pip includes the eMudhra/emSign CA removal
+        run: |
+          python -c "import sys, pip; v = tuple(int(p) for p in pip.__version__.split('.')[:3]); sys.exit(0 if v >= (26, 2, 2) else f'pip {pip.__version__} predates the eMudhra/emSign CA removal; need >= 26.2.2')"
       - name: Install build dependencies
         run: pip install build twine setuptools_scm
       - name: Publish Python package