Start with a fresh venv each time

The venv can get dirty between runs, it's best to start with a clean
one.

This will eventually need to be namespaced so that we can have multiple
runs going at the same time, or rely on some other segregation to keep
multiple runs from operating on the same paths at the same time.
Didn't we configure jenkins to rebuild the workspace each task? If so, that's what cleans it up. We're putting the venv inside the workspace, so cleaning the workspace cleans the venv.

It adds build time, but having the venv outside of the workspace creates a single point of failure, and makes it harder to run jobs concurrently.