chore: merge audit fixes (packcli)

# Conflicts:
#	README.md
#	scripts/generate_pack.py
#	scripts/pipeline.py

.github/workflows/validate.yml

@@ -201,12 +201,14 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       # install.py stays on Python 3.8: the suite runs it end to end under a
-      # real 3.8 interpreter, which import-only and grammar checks miss. The
-      # last version listed is the default python.
+      # real 3.8 interpreter, which import-only and grammar checks miss. 3.9
+      # is the floor pipeline.py states for the build scripts, compiled under
+      # a real 3.9. The last version listed is the default python.
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7
         with:
           python-version: |
             3.8
+            3.9
             3.12
 
       # markdown: the site validation test renders a wiki line to prove the