perf(python): add --compile-bytecode to uv pip install (#9393)

Python jobs under nsjail experience slow imports (~465ms for `import
requests`) because dependency directories are mounted read-only. Without
pre-compiled `.pyc` files, Python recompiles `.py` source to bytecode
in-memory on every import in every fresh nsjail process, paying the cost
repeatedly.

Add `--compile-bytecode` to both `uv pip install` invocations (the
Rust-driven install in python_executor.rs and the nsjail
download_deps.py.sh script) so `.pyc` files are generated at install
time and available at runtime even through read-only mounts. The files
are included in both the local cache and S3 piptar uploads.

The flag is supported by the uv version (0.9.24+) shipped in the
Dockerfile. The existing `__pycache__` skip only filters top-level dirs
for dedup logic, not subdirs within packages, so there is no conflict.

Fixes WIN-2001

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/windmill-worker/nsjail/download_deps.py.sh

@@ -31,6 +31,7 @@ $PY_PATH
 $INDEX_URL_ARG $EXTRA_INDEX_URL_ARG $TRUSTED_HOST_ARG
 --system
 --reinstall
+--compile-bytecode
 "
 
 echo $CMD

backend/windmill-worker/src/python_executor.rs

@@ -2095,6 +2095,9 @@ async fn spawn_uv_install(
             "--no-cache",
             // If we invoke uv pip install, then we want to overwrite existing data
             "--reinstall",
+            // Compile .py to .pyc at install time so imports are fast even
+            // through read-only nsjail mounts (no in-memory compilation per job).
+            "--compile-bytecode",
         ];
 
         if let Some(py_path) = py_path.as_ref() {