fix: audit locked Python dependencies reproducibly

[kriptoburak]

Summary

• move the dependency-audit hardening out of release PR release: 0.6.0 #21
• export only locked third-party dependencies
• require lockfile hashes during pip-audit
• disable installer resolution during the audit
• remove the temporary requirements file on exit

Root Cause

The previous audit inspected the synchronized environment. That environment includes the local, unreleased project version. During a release PR, pip-audit can treat that version as a published dependency and fail resolution before auditing third-party packages.

The new path derives its input directly from uv.lock. It excludes the local project and audits the hash-checked third-party dependency set.

Impact

Runtime APIs, package metadata, generated code, and public contracts do not change. Release PR #21 can return to metadata-only scope after this PR merges.

Validation

• bash -n scripts/audit
• locked dependency audit: no known vulnerabilities
• Ruff, Pyright, mypy, and import verification
• reproducible wheel and source archives
• 8,954 matrix tests passed; 40 skipped
• statement coverage: 94.19%
• branch coverage: 80.89%
• git diff --check
• security, simplification, and maintainability reviews found no additional issue

Signed-off-by: kriptoburak kriptoburak@users.noreply.github.com

Note

Audit locked Python dependencies using exported requirements file with hashes

Replaces the previous approach of syncing a locked environment and inspecting site-packages with a flow that exports locked third-party dependencies to a temporary requirements.txt and runs pip-audit against it.

• Uses uv export with --locked, --all-extras, --group pydantic-v2, --no-emit-project, and --format requirements-txt to generate the audit target
• Invokes pip-audit with --disable-pip, --require-hashes, and --requirement to audit the exported file
• Cleans up the temporary file after auditing
• Behavioral Change: audit no longer syncs or inspects installed packages; it now audits the locked dependency graph directly with hash verification

^{Macroscope summarized 2194737.}

[furkanerday]

Reviewed the complete diff, PR description, all conversation and review history, unresolved threads, repository policies, relevant contracts and tests, required checks, and commit sign-offs at 068114a. All required checks pass, no actionable thread remains, and I found no blocking issue.