self-test: Install sigstore-python in separate virtualenv

[jku]

This prevents sigstore-python dependencies from being accidentally used by the test suite.

Note that Makefile currently still installs everything in the same environment. Fixing this requires some additional work: either the documentation needs to include the use of venv when invoking the test suite manually (making the invocation even more complicated) or the sigstore-python-conformance entrypoint needs to somehow handle the virtual environment...

Fixes #180

[jku]

I think the PR is now correct (if a little ugly -- the way we invoke the wrapper could be a lot more straightforward).

The failure in the selftest is correct: we now reproduce #178. We can merge #179 first, then this should start passing (since we pin protobuf-specs at that point).

[woodruffw]

LGTM!

Thinking out loud: one thing we could do to speed up our own CI/conformance consumers a bit is use uv throughout. But that's totally unrelated to these fixes themselves 🙂

[di]

Trying to make sure I understand the goal here: we want to install sigstore-python, but use the sub-dependencies specified in the requirements.txt here and not it's sub dependencies, correct? Wouldn't pip install sigstore --no-deps do this?

[jku]

@di the goal is to install sigstore-python so that it does not poison the virtual environment for the test suite: The practical issue was that e.g. #178 does not appear in our self test but does break every user.

Current situation is:

• sigstore-python is first installed globally (no venv)
• the test suite is installed in its own venv but that finds the shared dependencies that have been installed globally

The already merged #179 does prevent this specific poisoning issue but the core problem remains: if sigstore-python and the test suite want to use different dependency versions, they should be able to.

This PR changes things so sigstore-python is installed in a separate venv. The only complication is that it makes the invocation a bit complicated (generated shell script calls the sigstore-python-conformance wrapper that calls "sigstore" binary): I'm pretty sure there is a simpler setup but it will require modifying the wrapper somehow

[jku]

I agree generating the script is not pretty but I'll merge as is: I think it still does the right thing and we can improve after the action is working again.

see #185 for improvements