fix(release): bind every validator to the locked Python

Author: rldyourmnd

.github/workflows/release-bundle.yml

@@ -91,6 +91,7 @@ jobs:
           GDS_TEST_PYTHON: ${{ runner.temp }}/gds-release-python/bin/python
         run: |
           python3 -m venv "${GDS_TEST_PYTHON%/bin/python}"
+          export PATH="${GDS_TEST_PYTHON%/python}:$PATH"
           "$GDS_TEST_PYTHON" -m pip install --quiet --require-hashes -r requirements/test.txt
           scripts/validate_release.sh
 

core/releasebuilder/workflow_contract_test.go

@@ -173,7 +173,8 @@ func TestHostedReleaseWorkflowInstallsLockedPythonDependenciesBeforeReleaseGate(
 		t.Fatal("release workflow must install hash-locked Python dependencies before validation")
 	}
 	if !strings.Contains(content, "GDS_TEST_PYTHON: ${{ runner.temp }}/gds-release-python/bin/python") ||
-		!strings.Contains(content, `python3 -m venv "${GDS_TEST_PYTHON%/bin/python}"`) {
+		!strings.Contains(content, `python3 -m venv "${GDS_TEST_PYTHON%/bin/python}"`) ||
+		!strings.Contains(content, `export PATH="${GDS_TEST_PYTHON%/python}:$PATH"`) {
 		t.Fatal("release workflow must run tests with the Python environment it populated")
 	}
 }