build: apply pip supply-chain hardening to new-integration workflow template (#3337)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: julian-risch

scripts/utils/templates/workflow.yml

@@ -74,7 +74,9 @@ jobs:
           python-version: ${{ matrix.python-version }}
 
       - name: Install Hatch
-        run: pip install --upgrade hatch
+        run: |
+          python -m pip install --upgrade pip
+          pip install hatch --uploaded-prior-to=P1D
       - name: Lint
         if: matrix.python-version == '3.10' && runner.os == 'Linux'
         run: hatch run fmt-check && hatch run test:types