build: add pip supply-chain hardening to CI workflows

Upgrade pip and pass --uploaded-prior-to=P1D to the hatch install
step in both test.yml and release.yml. This skips packages published
within the last 24 hours, mitigating the short-window exposure seen
in recent PyPI compromises. Mirrors the pattern applied across
deepset-ai/haystack-core-integrations in
deepset-ai/haystack-core-integrations#3258.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: julian-risch

.github/workflows/release.yml

@@ -24,7 +24,9 @@ jobs:
           python-version: "3.13"
 
       - name: Install Hatch
-        run: pip install hatch
+        run: |
+          python -m pip install --upgrade pip
+          pip install hatch --uploaded-prior-to=P1D
 
       - name: Build
         run: hatch build

.github/workflows/test.yml

@@ -36,7 +36,9 @@ jobs:
           python-version: ${{ matrix.python-version }}
 
       - name: Install Hatch
-        run: pip install hatch
+        run: |
+          python -m pip install --upgrade pip
+          pip install hatch --uploaded-prior-to=P1D
 
       - name: Lint
         if: matrix.python-version == '3.10' && runner.os == 'Linux'