gbfs CI: install the D1 verifier into its own venv

`uv pip install --system` fails on the runner: /usr is externally
managed (PEP 668), so uv refuses outright (exit 2). `uv venv` first,
then call the console script by path.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GgLAzeRJeNeyizG4XHWRBK

Author: ryan-williams

.github/workflows/gbfs.yml

@@ -78,15 +78,18 @@ jobs:
           [ -n "$rev" ] || { echo "no pyrmts rev found in pyproject.toml" >&2; exit 1; }
           echo "pyrmts @ $rev"
           base="git+https://github.com/runsascoded/pyrmts.git@$rev"
-          uv pip install --system \
+          # Own venv rather than `--system`: the runner's /usr interpreter is
+          # externally managed (PEP 668) and rejects installs outright.
+          uv venv
+          uv pip install \
             "pyrmts @ $base#subdirectory=python/pyrmts" \
             "pyrmts-engine @ $base#subdirectory=python/pyrmts_engine" \
             "pyrmts-ops @ $base#subdirectory=python/pyrmts_ops"
       - name: Verify D1 schema
         run: |
           id=$(sed -nE 's/^database_id = "([^"]+)"/\1/p' gbfs/api/wrangler.toml | head -1)
           [ -n "$id" ] || { echo "no database_id in gbfs/api/wrangler.toml" >&2; exit 1; }
-          pyrmts-ops d1 verify -d "$id"
+          .venv/bin/pyrmts-ops d1 verify -d "$id"
         env:
           # Its own token (`ctbk-gha-d1-read`), scoped to D1 Read and nothing
           # else — this job only ever reads `sqlite_master` and PRAGMAs, so it