put the venv first on PATH, or maturin cannot find zig

The release job failed on its first run. maturin locates zig by running
`python3 -m ziglang`, and `maturin[zig]` installs ziglang into the venv only,
so calling maturin by absolute path left a bare python3 resolving to the
system one, which does not have it. It died with 'Failed to find zig' after
apt and rustup had already run, and published nothing.

Reproduced locally, both the failure and the fix: with the venv first on PATH
the same command builds a manylinux_2_17 wheel, which is the whole reason for
--zig. The step now also prints the zig version before the loop, so a missing
toolchain fails in one line rather than three minutes in, and pip is no longer
quiet, so the log shows what was installed.

.forgejo/workflows/release.yml

@@ -42,14 +42,21 @@ jobs:
           # readme-renderer[md] is what makes `twine check` actually parse the
           # long description. Without it the render returns None and the
           # check reports PASSED regardless, even with --strict.
-          /tmp/venv/bin/pip install --quiet 'maturin[zig]' twine 'readme-renderer[md]'
+          /tmp/venv/bin/pip install 'maturin[zig]' twine 'readme-renderer[md]'
+          # The venv has to be first on PATH, not merely called by absolute
+          # path. maturin looks for zig by running `python3 -m ziglang`, and
+          # `maturin[zig]` puts ziglang in the venv only, so a bare python3
+          # resolves to the system one, which does not have it: "Failed to find
+          # zig", after apt and rustup have already run.
+          export PATH="/tmp/venv/bin:$PATH"
+          python3 -m ziglang version
           # --zig cross-compiles against an older glibc than this image ships, so
           # the wheel is not silently pinned to bookworm's.
           for target in x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu; do
             rustup target add "$target"
-            /tmp/venv/bin/maturin build --release --zig --target "$target" --out dist
+            maturin build --release --zig --target "$target" --out dist
           done
-          /tmp/venv/bin/maturin sdist --out dist
+          maturin sdist --out dist
           ls -l dist
 
       - name: Publish
@@ -63,8 +70,8 @@ jobs:
           TWINE_USERNAME: __token__
           TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
         run: |
-          /tmp/venv/bin/twine check --strict dist/*
+          twine check --strict dist/*
           # --skip-existing so a retry after a partial upload finishes the job
           # instead of dying on the first file. A version cannot be reused,
           # so a half-published release would otherwise burn it.
-          /tmp/venv/bin/twine upload --non-interactive --skip-existing dist/*
+          twine upload --non-interactive --skip-existing dist/*