pythontests: keep uv virtualenv outside the checkout

[nonprofittechy]

Summary

• nltk 3.10.1 shipped an import-time guard (nltk/inisec.py) meant to mitigate CWE-427 (uncontrolled search path) by blocking any import that resolves to a path inside the current working directory. It false-positives against a project-local .venv (uv's default), blocking nltk's own internal import regex and breaking test collection for every downstream repo pulling in docassemble.base (e.g. docassemble-ALDashboard run 31616118565).
• nltk has since fixed this in 3.10.3, but nothing stops another package from shipping a similar check in the future.
• This adds one step that points UV_PROJECT_ENVIRONMENT at $RUNNER_TEMP/venv before uv sync runs, so the virtualenv never lives inside $GITHUB_WORKSPACE. Everything downstream (uv sync, uv run mypy, uv run pytest) picks it up automatically via the exported env var.

Test plan

• Ran the equivalent of this action's steps locally against docassemble-ALDashboard with UV_PROJECT_ENVIRONMENT pointed outside the repo: uv sync --group dev, uv run mypy . --exclude '^build/' --explicit-package-bases, and uv run pytest docassemble/ALDashboard/test/ all pass (372 tests, 61 files clean under mypy).
• Confirm this workflow still passes in CI for at least one consuming repo (e.g. re-run docassemble-ALDashboard's mypy.yml against this branch via SuffolkLITLab/ALActions/pythontests@uv-venv-outside-workspace).

🤖 Generated with Claude Code