chore: pin virtualenv<21 for python 3.9

[godobyte]

What was the problem/requirement? (What/Why)

virtualenv 21+ removed the propose_interpreters attribute from virtualenv.discovery.builtin, which breaks hatch env create on Python 3.9 with the error:

Environment default is incompatible: module 'virtualenv.discovery.builtin' has no attribute 'propose_interpreters'

This prevents building and testing on Python 3.9 environments.

What was the solution? (How)

Pin virtualenv<21 only where Python 3.9 is used:

• pipeline/build.sh — added runtime Python version detection to conditionally pin only on 3.9
• testing_containers/localuser_sudo_environment/Dockerfile — pinned (uses python:3.9-bookworm base image)
• testing_containers/ldap_sudo_environment/Dockerfile — pinned (uses python:3.9-bookworm base image)
• .github/workflows/release_publish.yml — pinned in the build job that targets Python 3.9

Non-3.9 environments are unaffected and will continue to use the latest virtualenv.

What is the impact of this change?

No impact on functionality or public interfaces. This only affects build/test tooling to restore compatibility with Python 3.9.

How was this change tested?

See DEVELOPMENT.md for information on running tests.

• Have you run the unit tests?

Verified with Docker using the localuser_sudo_environment container (Python 3.9):

• With pin: hatch env create succeeds, full test suite passes (544 passed, 28 skipped)
• Without pin: hatch env create fails with module 'virtualenv.discovery.builtin' has no attribute 'propose_interpreters'

Verified pipeline/build.sh version detection logic:

• Python 3.9 container: correctly detects minor version 9, installs virtualenv<21 (gets 20.39.1)
• Python 3.12 container: correctly takes the else branch, installs latest virtualenv (gets 21.2.0)

Was this change documented?

• Inline comments added in Dockerfiles explaining the pin reason
• No public API docstring changes needed

Is this a breaking change?

No. This change only affects internal build and test tooling. No public interfaces are modified.

Does this change impact security?

No. This pins an existing build dependency to a known-good version range. No files, directories, or permissions are created or modified.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud