ci: bootstrap pip via get-pip (runner lacks python3-venv/ensurepip)

Create the venv with --without-pip (skips the missing ensurepip), then bootstrap
pip into it with get-pip.py and install mkdocs. Avoids apt/sudo and the Debian
PEP 668 restriction. Needs only python3 + network to PyPI. Chain validated
locally.