I would personally go with something like Lua - small, trivial to embed, multiple implementations to pick from, etc. It would fit exactly where the shell falls short.
have you ever tried bootstrapping python? because it's really not a big deal (the only hard dependencies are a C compiler, libffi, and zlib, though distros also add libedit or readline, expat, sqlite, bzip2, xz, and openssl, all trivial dependencies present in more or less any system); tkinter is pretty much always compiled and packaged separately
meanwhile with lua you'd need many additional modules, and the templates would be verbose and far less readable
a non-exhaustive list of stuff python provides that would need to be provided separately:
1) subprocess management 2) path parsing (and normalization, manipulation, etc.) 3) various filesystem operations 4) shell command lexing 5) globs and fnmatch patterns 6) json 7) date/time handling 8) filesystem advisory locks 9) temporary file handling 10) http client (for sources fetching without external subprocess) 11) termios and ptys (for isolation of controlling terminal) 12) regex 13) hashing 14) topological graph sorting 15) cmdline argument parsing 16) readline functionality 17) thread/task pools
and so on and so on
cbuild started iirc with python 3.8, currently it requires at least 3.12 due to some features (it will stay on that minimum for a while, though newer versions are always supported), updating it has always been seamless though
My point is that Lua-the-language provides similar expressive power to Python-the-language (including basic stuff like lookup tables), while remaining smaller and simpler to understand than the POSIX shell. It's also simpler to vendor than Python, and you probably want to vendor this kind of stuff to avoid the pain of bootstrapping / circular dependencies.
Now I haven't built a build/packaging system like xbps or apk (few people did), but I've been in charge of devops/releng at work for a decade - and if I learned anything at all, it's that it's better to start with the simplest tool that can do the job, and slowly add what you need. E.g. I wrote a tool in 2016 to replace Ansible in my team, and all of this time it's just been doing its job: <https://github.com/rollcat/judo>. Turned out nobody actually needed the kitchen sink.
What would you say is its biggest shortcoming?