Just thinking out loud: this is going to be really annoying to test. I guess we could mock it out, but that won't guarantee that I got the exact callsite right here.

I looked into this a bit more, and I mis-diagnosed this slightly originally: the error here isn't from our own code, but from venv itself: the _setup_pip function uses subprocess internally, which then explodes for the original noexec reason. So current patch is wrong.

Ref: https://github.com/python/cpython/blob/a5f49ce65ef83c41c9cc87566fe59be766d0f3ca/Lib/venv/__init__.py#L357-L360