fix: pin secure CLI build tooling

Fixes the composite build helper with secure versions already aligned to the project toolchain.\n\nAssisted-by: Codex:GPT-6

Author: jdalton

.github/actions/setup-hatch/action.yml

@@ -9,5 +9,4 @@ runs:
     - shell: bash
       run: |
         python -m pip install --upgrade pip
-        pip install "virtualenv<20.36"
-        pip install hatchling==1.27.0 hatch==1.14.0
+        python -m pip install "hatch==1.18.1" "hatchling==1.32.4" "virtualenv==21.12.1"