Use "safe" pip on account of the eMudhra compromise #33142

Grok suggest the following list of places the need fixing. It probably makes sense to use AI for this task.

Workflows / places that need a safe pip install

Needs the safe pip bootstrap

• linux.yml
  • smoke_test
  • all_versions
  • full
  • benchmark
  • sdist
  • array_api_tests
  • ml_dtypes_compat
  • armhf_test (inside the docker venv)
• windows.yml
  • clangcl_python64bit_openblas32
  • msvc_python_x86_arm64_no_openblas
  • msvc_python64bit_openblas
• macos.yml
  • accelerate job (the setup-python path)
• lint.yml
  • lint job
• .github/meson_actions/action.yml
  • composite action (used by several linux jobs)

Already OK (no change needed)

• typecheck.yml (uses uv)
• pixi-packages.yml (pixi)
• macos.yml conda job (conda)
• dependency-review.yml, codeql.yml, scorecards.yml, etc. (no pip installs)

Suggested fix

Add this step immediately after every actions/setup-python (and inside the docker/venv in armhf, and at the top of meson_actions):

- name: Install safe pip
  run: |
    python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"