dockerfile: isolate Python deps in venv

Dockerfile

@@ -18,6 +18,8 @@ FROM nvidia/cuda:12.4.1-runtime-ubuntu22.04
 ENV PYTHONUNBUFFERED=1 \
     PYTHONDONTWRITEBYTECODE=1 \
     PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    VIRTUAL_ENV=/opt/venv \
+    PATH="/opt/venv/bin:$PATH" \
     DEBIAN_FRONTEND=noninteractive
 
 # Python 3.12 from deadsnakes (Ubuntu 22.04 ships 3.10 by default)
@@ -37,12 +39,11 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && ln -sf /usr/bin/python3.12 /usr/local/bin/python \
     && ln -sf /usr/bin/python3.12 /usr/local/bin/python3
 
-# Bootstrap pip for Python 3.12. Ubuntu 22.04's apt `python3-pip`
-# is built against the system Python 3.10 and depends on the
-# `distutils` module that 3.12 removed; invoking it under 3.12
-# raises ModuleNotFoundError: distutils. ensurepip ships with the
-# 3.12 stdlib and gives us a matching pip.
-RUN python -m ensurepip --upgrade \
+# Build the runtime Python environment in a venv. The CUDA/deadsnakes
+# apt setup leaves distro Python modules (for example blinker) on the
+# system path; isolating pip installs avoids trying to uninstall
+# apt-owned distutils packages during dependency resolution.
+RUN python -m venv "$VIRTUAL_ENV" \
     && python -m pip install --no-cache-dir --upgrade pip
 
 # cadgenbench from the Public GitHub repo, same convention and ARG name