This is exactly my point. .venv/ needs to live in the project deployment directory, and needs a wrapper script to use the python binary/symlink therein.

Isolate the project from the python runtime it uses, and you'll always have the right set of packages installed.

None of this is perfect, but an in-tree .venv/ and convenience scripts seems to be the least-worst option.