gh-151544: Fixes CVE-2026-12003 by removing the fallback to %VPATH%/Modules/Setup.local for discovering sources in getpath.py

[zooba]

• Issue: [CVE-2026-12003] In-tree search paths can be enabled without modifying install directory #151544

[bedevere-bot]

🤖 New build scheduled with the buildbot fleet by @zooba for commit 70871e1 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F151545%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

[zooba]

!buildbot .*Android PR

[bedevere-bot]

🤖 New build scheduled with the buildbot fleet by @zooba for commit 70871e1 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F151545%2Fmerge

The command will test the builders whose names match following regular expression: .*Android PR

The builders matched are:

• AMD64 Android PR
• aarch64 Android PR

[zooba]

Change has been reviewed separately with no concerns raised, and the buildbots are happy. We're not expediting releases for this one.

[miss-islington-app]

Thanks @zooba for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

[bedevere-app]

GH-151564 is a backport of this pull request to the 3.15 branch.

[bedevere-app]

GH-151565 is a backport of this pull request to the 3.14 branch.

[bedevere-app]

GH-151566 is a backport of this pull request to the 3.13 branch.

[bedevere-app]

GH-151567 is a backport of this pull request to the 3.12 branch.

[bedevere-app]

GH-151568 is a backport of this pull request to the 3.11 branch.