workflows: Restore the dependency cache before creating the virtual environment

[jtrobles-cdd]

The Build job of the CI workflow fails at make python-pip-install with ImportError: cannot import name 'get_runnable_pip' from 'pip._internal.utils.misc', in every job that gets a cache hit. Nothing merged into develop caused it: the last run of develop that missed the cache passed, and the very next run, which hit the cache that run had just saved, failed.

Cause

• The Build job creates the virtual environment and only then restores the cache into it, and actions/cache restores by extracting an archive over the workspace, so the cached Pip installation gets merged with the one python -m venv bootstraps instead of replacing it.
• The merge was harmless only while both Pip versions laid out their internal modules the same way. Pip 26.2 turned module pip/_internal/build_env.py into a package of the same name, and moved get_runnable_pip() out of pip/_internal/utils/misc.py.
• The interpreters actions/setup-python currently installs bootstrap Pip 26.2.1, while this project pins 26.0.1, so the build_env/ package of 26.2.1 survives the merge and shadows the build_env.py module of 26.0.1. Pip 26.0.1 then loads the build_env.installer module of 26.2.1, which imports get_runnable_pip from a utils.misc that no longer provides it.
• The Test job is unaffected because it restores the cache into a checkout that holds no virtual environment.

Not Bumping Pip Instead

• Pinning Pip 26.2 would sidestep the version mismatch, and it cannot be done yet: dependabot/pip/pip-26.2 fails in make python-deps-sync-check because pip-tools 7.5.3 imports stdlib_pkgs from pip._internal.utils.compat, which Pip 26.2 removed.
• The reordering in this pull request is what actually fixes the failure, and it holds for whatever Pip the runner's interpreters bootstrap next.

Verification

• Reproduced outside CI, by extracting an archive of a virtual environment holding Pip 26.0.1 over a virtual environment holding Pip 26.2.1: the merged Pip fails with the same traceback, pip/_internal/build_env.py and pip/_internal/build_env/ are both present afterwards, and extracting the same archive into a directory holding no virtual environment yields a working Pip.
• The cache key does not hash .github/workflows/ci.yaml, so the first run of this branch reuses the cache saved by develop and therefore exercises the cache hit that was failing, rather than the cache miss that already passed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud