fix: install pip transiently in builder, not in requirements

pip is needed only by setup_oss_compliance.sh during the build.
Install it via uv in each builder stage rather than pinning it in
requirements files, so it never appears as an explicit dependency.

Signed-off-by: Junpu Fan <junpu@amazon.com>

Author: junpuf

docker/lambda/Dockerfile

@@ -68,7 +68,8 @@ COPY --from=lambda-python /var/lang/lib /var/lang/lib
 RUN rm -rf /var/lang/lib/python3.13/site-packages
 ENV PATH="/var/lang/bin:$PATH"
 COPY ./docker/lambda/requirements-base.txt /tmp/requirements.txt
-RUN --mount=type=cache,target=/root/.cache/uv uv pip install --python /var/lang/bin/python3.13 -r /tmp/requirements.txt
+RUN --mount=type=cache,target=/root/.cache/uv uv pip install --python /var/lang/bin/python3.13 pip==25.3 \
+  && uv pip install --python /var/lang/bin/python3.13 -r /tmp/requirements.txt
 
 # ============================================================
 # CuPy builder (Python 3.13 — awslambdaric, CuPy, NumPy, SciPy, etc.)
@@ -81,7 +82,8 @@ RUN rm -rf /var/lang/lib/python3.13/site-packages
 ENV PATH="/var/lang/bin:$PATH"
 COPY ./docker/lambda/requirements-cupy.txt /tmp/requirements.txt
 RUN --mount=type=cache,target=/root/.cache/uv \
-  uv pip install --python /var/lang/bin/python3.13 -r /tmp/requirements.txt \
+  uv pip install --python /var/lang/bin/python3.13 pip==25.3 \
+  && uv pip install --python /var/lang/bin/python3.13 -r /tmp/requirements.txt \
   && uv pip check --python /var/lang/bin/python3.13 \
   && (find /var/lang -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null; true) \
   && find /var/lang -type f -name "*.pyc" -delete \
@@ -98,7 +100,8 @@ RUN rm -rf /var/lang/lib/python3.13/site-packages
 ENV PATH="/var/lang/bin:$PATH"
 COPY ./docker/lambda/requirements-pytorch.txt /tmp/requirements.txt
 RUN --mount=type=cache,target=/root/.cache/uv \
-  uv pip install --index-strategy unsafe-best-match --python /var/lang/bin/python3.13 -r /tmp/requirements.txt \
+  uv pip install --python /var/lang/bin/python3.13 pip==25.3 \
+  && uv pip install --index-strategy unsafe-best-match --python /var/lang/bin/python3.13 -r /tmp/requirements.txt \
   && uv pip check --python /var/lang/bin/python3.13 \
   && (find /var/lang -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null; true) \
   && (find /var/lang -type d -name tests -exec rm -rf {} + 2>/dev/null; true) \

docker/lambda/requirements-base.txt

@@ -1,5 +1,4 @@
 awslambdaric==3.1.1
-pip==25.3
 pip-licenses==5.5.1
 requests==2.32.5
 setuptools==78.1.1

docker/lambda/requirements-cupy.txt

@@ -5,7 +5,6 @@ cvxpy==1.8.1
 numba==0.64.0
 numpy==2.4.2
 pandas==3.0.1
-pip==25.3
 pip-licenses==5.5.1
 requests==2.32.5
 scipy==1.17.1

docker/lambda/requirements-pytorch.txt

@@ -8,7 +8,6 @@ librosa==0.11.0
 numpy==2.4.2
 opencv-python-headless==4.13.0.92
 pillow==12.1.1
-pip==25.3
 pip-licenses==5.5.1
 requests==2.32.5
 safetensors==0.7.0