Fix PEP 668 failures in Linux host CI jobs (#33812)
### Description
<!-- Describe your changes. -->
Set up managed Python 3.12 using the existing SHA-pinned
`actions/setup-python` version before Python-dependent steps in eight
Linux host jobs:
- Android: binary-size baseline, NNAPI EP, and CPU EP.
- Linux minimal: full ORT, custom ops, type reduction, and globally
allowed types.
- React Native: Android AAR package generation.
This is a PEP-only change based directly on `main`: three workflow
files, 40 added lines. It does not include container interpreter changes
or `--break-system-packages`.
### Motivation and Context
<!-- - Why is this change required? What problem does it solve?
- If it fixes an open issue, please link to the issue here. -->
Ubuntu 24.04's distro Python correctly enforces PEP 668, including for
`pip install --user`. During validation on the Ubuntu2404 image37.0.0
runner image, host jobs selected `/usr/bin/python3` and failed with
`error: externally-managed-environment` before building:
- [Minimal Globally Allowed Types
failure](https://github.com/microsoft/onnxruntime/actions/runs/41456643765/job/125314899502)
and [full ORT
failure](https://github.com/microsoft/onnxruntime/actions/runs/41456643765/job/125314899733).
- [React Native Android AAR dependency installation
failure](https://github.com/microsoft/onnxruntime/actions/runs/41456689510/job/125315059136).
The downstream host commands and build actions resolve
`python`/`python3` from PATH, so initializing managed Python selects an
installable interpreter without weakening the distro protection. Python
3.12 and the action SHA match existing repository usage, including the
lint workflow and React Native Android tests. Docker-only minimal jobs
are left untouched.
Validation:
- `git diff --check` — passed.
- Focused PyYAML parsing and assertions — passed for all three
workflows: exactly eight setup steps, Python 3.12, full action SHA pins,
setup before dependent steps, and semantic equality with `origin/main`
after removing those eight additions. This also checks that runner
routing and all other job contents are unchanged.
- Inspected the pinned host build actions and local Android scripts for
interpreter selection.
- On the separate migration validation branch at commit
`3c88d48ba1a893e8ea6192687e2423f373cccea5` with the same Python setup
patch on image37, [Android
CI](https://github.com/microsoft/onnxruntime/actions/runs/41458188138)
completed successfully (3/3 jobs), [Linux CPU Minimal Build
E2E](https://github.com/microsoft/onnxruntime/actions/runs/41458193370)
completed successfully (10/10 jobs), and [Android AAR package
generation](https://github.com/microsoft/onnxruntime/actions/runs/41458197961/job/125320204515)
completed successfully. Together these results cover all eight
managed-Python host placements, including the three originally failing
jobs. These are migration-branch results, not this PR's head CI.
- [React Native
CI](https://github.com/microsoft/onnxruntime/actions/runs/41458197961)
completed with a separate downstream failure: [React Native CI
Android](https://github.com/microsoft/onnxruntime/actions/runs/41458197961/job/125335908442)
failed during `npm install -g detox-cli` with `EACCES` creating
`/opt/hostedtoolcache/node/24.22.2/x64/lib/node_modules/detox-cli`. AAR
generation and the unchanged iOS build/E2E jobs passed; full React
Native workflow success is not claimed.
- No duplicate expensive validation runs were dispatched for this PR;
its own CI results remain to be established. Local Linux builds were not
run from this Windows worktree.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
