Fix web refresh Actions on PEP 668 system Python.

Use a job-local venv so pip install no longer fails with externally-managed-environment on the Mac mini runner.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/web-weekly.yml

@@ -36,7 +36,9 @@ jobs:
           PYTHON=python3
           command -v python3 >/dev/null || PYTHON=python
           command -v node >/dev/null || { echo "node/npx required for wrangler deploy"; exit 1; }
-          "$PYTHON" -m pip install -q -r web/requirements.txt
+          # Job-local venv: Homebrew/PEP 668 blocks system pip install.
+          "$PYTHON" -m venv .venv
+          .venv/bin/pip install -q -r web/requirements.txt
 
       - name: Refresh weekly tier
         env:
@@ -49,9 +51,7 @@ jobs:
           OSS_ACCESS_KEY_SECRET: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
         run: |
           set -e
-          PYTHON=python3
-          command -v python3 >/dev/null || PYTHON=python
-          "$PYTHON" web/refresh_web.py --tier weekly
+          .venv/bin/python web/refresh_web.py --tier weekly
 
       - name: Save refresh summary
         if: always()