fix: install pip transiently in builder, not in requirements

pip is needed only by setup_oss_compliance.sh during the build.
Install it via uv in each builder stage rather than pinning it in
requirements files, so it never appears as an explicit dependency.

Signed-off-by: Junpu Fan <junpu@amazon.com>

Author: junpuf

docker/lambda/Dockerfile

@@ -68,8 +68,7 @@ COPY --from=lambda-python /var/lang/lib /var/lang/lib
 RUN rm -rf /var/lang/lib/python3.13/site-packages
 ENV PATH="/var/lang/bin:$PATH"
 COPY ./docker/lambda/requirements-base.txt /tmp/requirements.txt
-RUN --mount=type=cache,target=/root/.cache/uv uv pip install --python /var/lang/bin/python3.13 pip==25.3 \
-  && uv pip install --python /var/lang/bin/python3.13 -r /tmp/requirements.txt
+RUN --mount=type=cache,target=/root/.cache/uv uv pip install --python /var/lang/bin/python3.13 -r /tmp/requirements.txt
 
 # ============================================================
 # CuPy builder (Python 3.13 — awslambdaric, CuPy, NumPy, SciPy, etc.)
@@ -82,8 +81,7 @@ RUN rm -rf /var/lang/lib/python3.13/site-packages
 ENV PATH="/var/lang/bin:$PATH"
 COPY ./docker/lambda/requirements-cupy.txt /tmp/requirements.txt
 RUN --mount=type=cache,target=/root/.cache/uv \
-  uv pip install --python /var/lang/bin/python3.13 pip==25.3 \
-  && uv pip install --python /var/lang/bin/python3.13 -r /tmp/requirements.txt \
+  uv pip install --python /var/lang/bin/python3.13 -r /tmp/requirements.txt \
   && uv pip check --python /var/lang/bin/python3.13 \
   && (find /var/lang -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null; true) \
   && find /var/lang -type f -name "*.pyc" -delete \
@@ -100,8 +98,7 @@ RUN rm -rf /var/lang/lib/python3.13/site-packages
 ENV PATH="/var/lang/bin:$PATH"
 COPY ./docker/lambda/requirements-pytorch.txt /tmp/requirements.txt
 RUN --mount=type=cache,target=/root/.cache/uv \
-  uv pip install --python /var/lang/bin/python3.13 pip==25.3 \
-  && uv pip install --index-strategy unsafe-best-match --python /var/lang/bin/python3.13 -r /tmp/requirements.txt \
+  uv pip install --index-strategy unsafe-best-match --python /var/lang/bin/python3.13 -r /tmp/requirements.txt \
   && uv pip check --python /var/lang/bin/python3.13 \
   && (find /var/lang -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null; true) \
   && (find /var/lang -type d -name tests -exec rm -rf {} + 2>/dev/null; true) \

docker/lambda/requirements-base.txt

@@ -1,4 +1,5 @@
 awslambdaric==3.1.1
+pip==25.3
 pip-licenses==5.5.1
 requests==2.32.5
 setuptools==78.1.1

docker/lambda/requirements-cupy.txt

@@ -5,6 +5,7 @@ cvxpy==1.8.1
 numba==0.64.0
 numpy==2.4.2
 pandas==3.0.1
+pip==25.3
 pip-licenses==5.5.1
 requests==2.32.5
 scipy==1.17.1

docker/lambda/requirements-pytorch.txt

@@ -8,6 +8,7 @@ librosa==0.11.0
 numpy==2.4.2
 opencv-python-headless==4.13.0.92
 pillow==12.1.1
+pip==25.3
 pip-licenses==5.5.1
 requests==2.32.5
 safetensors==0.7.0