dockerfile: bootstrap pip for python 3.12 via ensurepip

Dockerfile

@@ -30,7 +30,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && add-apt-repository -y ppa:deadsnakes/ppa \
     && apt-get update && apt-get install -y --no-install-recommends \
         python3.12 python3.12-venv python3.12-dev \
-        python3-pip \
         git ca-certificates \
         libglib2.0-0 libsm6 libxext6 libgomp1 libfontconfig1 \
         libgl1 libegl1 libegl-mesa0 libxrender1 \
@@ -38,6 +37,14 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && ln -sf /usr/bin/python3.12 /usr/local/bin/python \
     && ln -sf /usr/bin/python3.12 /usr/local/bin/python3
 
+# Bootstrap pip for Python 3.12. Ubuntu 22.04's apt `python3-pip`
+# is built against the system Python 3.10 and depends on the
+# `distutils` module that 3.12 removed; invoking it under 3.12
+# raises ModuleNotFoundError: distutils. ensurepip ships with the
+# 3.12 stdlib and gives us a matching pip.
+RUN python -m ensurepip --upgrade \
+    && python -m pip install --no-cache-dir --upgrade pip
+
 # cadgenbench from the Public GitHub repo, same convention and
 # ARG name as the leaderboard Dockerfile. Bump CADGENBENCH_SHA in
 # lockstep with cadgenbench releases.