Reinstate pip-overrides option for test jobs

Paramiko needs it and I don't see an obviously better way just yet.
Probably using dependency-groups later but the overall mechanism would
look very similar here...

Modernization

- Python 3.9+, for various reasons. I tried to support 3.8, promise; it
  just wasn't to be.
- latest non-broken stable version of Circle's Python orb
- uv pkg-manager
- remove all references to pip, including ci-specific escape hatch
(expecting to add back as a convention-based pyproject.toml
dependency-group somehow, if necessary, I forget which project/s used
that feature)
- force use of an out-of-band virtualenv location (sadly, repeated a
  bit)

Cut out user site-packages, it screws up sudo envs now?

Now tagging to match 'org publish' versions...this is 1.3.0