Fix CI: macOS Python toolcache permissions, Windows pip invocation

- Create /Users/runner directory on macOS before setup-python (permission fix)
- Use `python -m pip` everywhere instead of calling pip directly (Windows fix)
- Refactor build_sidecar.py to use pip_install() helper via python -m pip

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

python/build_sidecar.py

@@ -68,32 +68,33 @@ def create_venv_and_install(cpu_only: bool) -> Path:
     print(f"[build] Creating venv at {venv_dir}")
     subprocess.run([sys.executable, "-m", "venv", str(venv_dir)], check=True)
 
-    # Determine pip and python paths inside venv
+    # Determine python path inside venv — use `python -m pip` instead of
+    # calling pip directly to avoid permission errors on Windows
     if sys.platform == "win32":
-        pip = str(venv_dir / "Scripts" / "pip")
         python = str(venv_dir / "Scripts" / "python")
     else:
-        pip = str(venv_dir / "bin" / "pip")
         python = str(venv_dir / "bin" / "python")
 
+    def pip_install(*args: str) -> None:
+        subprocess.run([python, "-m", "pip", *args], check=True)
+
     # Upgrade pip
-    subprocess.run([pip, "install", "--upgrade", "pip"], check=True)
+    pip_install("install", "--upgrade", "pip", "setuptools", "wheel")
 
     # Install torch (CPU-only to avoid bundling ~2GB of CUDA libs)
     if cpu_only:
         print("[build] Installing PyTorch (CPU-only)")
-        subprocess.run(
-            [pip, "install", "torch", "torchaudio",
-             "--index-url", "https://download.pytorch.org/whl/cpu"],
-            check=True,
+        pip_install(
+            "install", "torch", "torchaudio",
+            "--index-url", "https://download.pytorch.org/whl/cpu",
         )
     else:
         print("[build] Installing PyTorch (default, may include CUDA)")
-        subprocess.run([pip, "install", "torch", "torchaudio"], check=True)
+        pip_install("install", "torch", "torchaudio")
 
     # Install project and dev deps (includes pyinstaller)
     print("[build] Installing project dependencies")
-    subprocess.run([pip, "install", "-e", f"{SCRIPT_DIR}[dev]"], check=True)
+    pip_install("install", "-e", f"{SCRIPT_DIR}[dev]")
 
     return Path(python)