fix: avoid unnecessary system pip dependency

[bxvtr]

Summary

• remove unnecessary system python3-pip dependency from managed-node Kubernetes runtime bootstrap
• keep python3-venv as the direct distro prerequisite
• strengthen contract test
• add required Unreleased changelog entry

Live defect evidence

• fresh OCI Ubuntu 24.04 arm64 clean-room deploy failed because python3-pip required python3-wheel with no installable candidate
• apt-get -s install python3-venv exited 0
• apt-get -s install python3-pip exited 100
• no manual node workaround applied

Test plan

• independent PRE-COMMIT review approved
• relevant static/unit validation PASS
• ShellCheck / Ansible lint SKIP only where unavailable

Scope

• no Terraform
• no deploy/verify tool changes
• no Argo/K8s manifest changes
• no live infrastructure mutation during implementation/review