build: bootstrap pip>=26.0 with ISO datetime cutoff to fix Python 3.9 CI

[gibiw]

Summary

After #485 introduced supply-chain protection via PIP_UPLOADED_PRIOR_TO: "P3D", every job that actually runs pip install on Python 3.9 fails:

ERROR: Could not find a version that satisfies the requirement pip>=26.1
(... 26.0.1)
ERROR: No matching distribution found for pip>=26.1

Root cause:

• The relative-duration form (P3D) is only accepted by pip>=26.1.
• pip 26.1 itself requires Python>=3.10, so it's never resolvable on 3.9 (max available: pip 26.0.1).
• This affects the test matrix on 3.9 and the build-n-publish job, which is pinned to 3.9.
• On main the breakage is hidden because the test job's paths-filter gate skips the install step on commits that don't touch the affected reporter directory; in any reporter PR (e.g. #488) it fires.

Change

• Drop the workflow-level PIP_UPLOADED_PRIOR_TO env.
• Add a Compute supply-chain cutoff step in each job that computes a fresh ISO 8601 datetime (3 days ago) and writes it to $GITHUB_ENV. ISO datetime is the original form pip 26.0 accepts and is supported on all Python versions in the matrix.
• Lower the bootstrap pin from pip>=26.1 to pip>=26.0.
• Keep the env -u PIP_UPLOADED_PRIOR_TO bootstrap dance so a stale seeded pip in fresh venvs doesn't choke on the env var as an unknown CLI flag.
• Update the surrounding comments.

Test plan

• YAML parses cleanly.
• CI green across the whole matrix once this PR runs, including Python 3.9 on every reporter directory.