fix: pin maturin to the project venv for coglet wheel builds (#3144)
`mise run build:coglet:wheel*` creates a `.venv` but never points
`maturin` at it. Without an active venv, maturin's interpreter
discovery scans `uv`'s Python registry -- installed *and*
downloadable pythons -- and can resolve a version to the wrong
implementation. On a machine with both a real `cpython-3.11` and an
uninstalled `pypy-3.11` registered, maturin picked the PyPy one,
generated a `PYO3_CONFIG_FILE` with `implementation=PyPy`, and the
build broke on `pyo3::Python::initialize()`, which pyo3 only defines
for CPython/GraalPy.
CI never hits this: it builds in a clean manylinux container via
`PyO3/maturin-action` with no ambient interpreter noise. Locally,
it's one bad match away. Passing `-i .venv/bin/python` to every
maturin invocation makes the interpreter deterministic instead of
environment-dependent.
Also bumps pyo3-stub-gen 0.20 -> 0.23, which is the first release to
declare its `pyo3` compatibility range (`>=0.27.0, <0.30.0`) instead
of leaving it unstated. Not required to fix the build above, but 0.20
predates the crate's `pyo3 = "0.27"` pin and has no declared bound
against it. The bump changes generated stub output slightly (drops a
now-redundant `from . import _sdk` import in `_impl.pyi`), so the
committed stubs are regenerated to match.