ci: Use exact Python version

[ThiefMaster]

Otherwise we can get problems when the setup job runs on a different patch release than the test/lint job because the symlink in the venv points to an exact x.y.z release