ci: make the Cygwin pip pin durable

Review feedback: Pin against a persistent package source.

Ordinary Cygwin mirrors retain only a rolling set of package versions, so the exact setup package selection would eventually disappear. Create the virtual environment without ensurepip, download pip 26.0.1 from its immutable PyPI file URL, verify its SHA-256 digest, and bootstrap that wheel directly. Avoid upgrading pip afterward so the broken 26.2.1 release is not reintroduced.

Validated with git diff --check, Ruby YAML parsing, and a local no-pip virtual-environment bootstrap using the pinned wheel.

Author: codex

.github/workflows/cygwin-test.yml

@@ -45,7 +45,7 @@ jobs:
     - name: Install Cygwin
       uses: cygwin/cygwin-install-action@v6
       with:
-        packages: git python312 python-pip-wheel=26.0.1-1 python-setuptools-wheel python-wheel-wheel
+        packages: curl git python312
         add-to-path: false  # No need to change $PATH outside the Cygwin environment.
 
     - name: Arrange for verbose output
@@ -73,12 +73,16 @@ jobs:
 
     - name: Set up virtual environment
       run: |
-        python3.12 -m venv .venv
+        pip_wheel=/tmp/pip-26.0.1-py3-none-any.whl
+        python3.12 -m venv --without-pip .venv
+        curl -fsSLo "$pip_wheel" https://files.pythonhosted.org/packages/de/f0/c81e05b613866b76d2d1066490adf1a3dbc4ee9d9c839961c3fc8a6997af/pip-26.0.1-py3-none-any.whl
+        python3.12 -c 'import hashlib, pathlib, sys; assert hashlib.sha256(pathlib.Path(sys.argv[1]).read_bytes()).hexdigest() == sys.argv[2]' "$pip_wheel" bdb1b08f4274833d62c1aa29e20907365a2ceb950410df15fc9521bad440122b
+        PYTHONPATH="$pip_wheel" .venv/bin/python -m pip install "$pip_wheel"
         echo 'BASH_ENV=.venv/bin/activate' >>"$GITHUB_ENV"
 
     - name: Update PyPA packages
       run: |
-        python -m pip install -U pip 'setuptools; python_version<"3.12"' wheel
+        python -m pip install -U 'setuptools; python_version<"3.12"' wheel
 
     - name: Install project and test dependencies
       run: |