fix(build): pass base-prefix Python to cmake for SWIG bindings (#216) (#219)

* fix(build): pass base-prefix Python to cmake for SWIG bindings (#216)

When running via pixi+uv, cmake's find_package(Python3) resolves the
thin uv venv Python which lacks python3.XX-config.  Pass
-DPython3_EXECUTABLE pointing at the base-prefix interpreter (the pixi
env) so cmake finds the config script it needs.

Closes #216

* fix(ci): bump pillow 12.1.1→12.2.0 and pytest 9.0.2→9.0.3

Resolves CVE-2026-40192 (pillow) and CVE-2025-71176 (pytest) that
cause the pip-audit CI step to fail on all open PRs.

* fix(build): warn when base Python is not found

Without this, the cmake Python workaround silently degrades to
the broken auto-detection it was meant to bypass.

---------

Co-authored-by: BANANASJIM <bananasjim1@gmail.com>

Author: K1ngst0m

src/rdc/_build_renderdoc.py

@@ -377,6 +377,13 @@ def configure_build(
     cmd += CMAKE_COMMON_FLAGS
     cmd.append(f"-DRENDERDOC_SWIG_PACKAGE={swig_dir}")
 
+    # Use base_prefix Python so cmake finds python3.XX-config (venv lacks it)
+    base_python = Path(sys.base_prefix) / "bin" / Path(sys.executable).name
+    if base_python.exists():
+        cmd.append(f"-DPython3_EXECUTABLE={base_python}")
+    else:
+        _log(f"WARNING: base Python not found at {base_python}, cmake will auto-detect")
+
     env = dict(os.environ)
     if plat == "linux":
         _log("stripping LTO flags")