build: the gate is scripts/check.sh, and CI goes

The Gitea Actions gate repeated, after the merge, what a release already runs
before it, and its runner shared the git host's container: one run there
starved Gitea of memory until it stopped answering. The lanes now live in
scripts/check.sh, run the same by the release dispatcher and by hand, and the
gate-contract test holds its lines (the ruff and pip-audit checks read it
instead of the workflow). The two audits only CI ran join the gate: pip-audit
over the lock (pinned in the test image, blocking at any severity) and npm
audit of the production dependencies. The engine contracts drop the CI
containers; the register records that pushes have no server-side gate.

backend/requirements-dev.txt

@@ -9,8 +9,10 @@
 # writes is keyed to the diagnostics THIS version produces.
 # pytest-cov: the coverage REPORT the gate prints (E32 D4) — a number to read, deliberately with no
 # threshold; "every regression test seen red" is the bar, not a percentage.
+# pip-audit: the gate's audit of requirements.lock (scripts/check.sh), blocking at any severity.
 basedpyright==1.40.1
 pytest==8.4.2
 pytest-cov==7.1.0
 ruff==0.15.21
 httpx2==2.13.0
+pip-audit==2.10.1

backend/requirements.lock

@@ -1,9 +1,9 @@
 # Pinned dependency lock for reproducible builds (SEC-5). GENERATED — do not hand-edit.
 # Source of truth is requirements.txt (the floor ranges); regenerate after editing it with:
 #   docker run --rm -v "$PWD":/b python:3.12-slim sh -c 'pip install -q -r /b/requirements.txt && pip freeze --exclude pip --exclude setuptools --exclude wheel' | sort
-# The prod Dockerfile + Dockerfile.test + CI install THIS file; pip-audit scans it in CI (blocking
-# since E32). A security fix may be ONE pin bumped in place instead of a full regeneration, which
-# would move every other package too — then `pip install -r requirements.lock && pip check` must
+# The prod Dockerfile + Dockerfile.test install THIS file; the gate's pip-audit (scripts/check.sh)
+# scans it, blocking since E32. A security fix may be ONE pin bumped in place instead of a full
+# regeneration, which would move every other package too — then `pip install -r requirements.lock && pip check` must
 # pass. In place so far: urllib3 2.7.0 -> 2.8.0 (PYSEC-2026-4175/4176/4177, E32).
 APScheduler==3.11.3
 Authlib==1.7.2

backend/tests/conftest.py

@@ -39,7 +39,7 @@ _MISSING = object()
 
 # A would-be silent skip (no DB, or no ffmpeg) is a hard error unless the run says otherwise — the
 # suite must not print green while the DB-backed / ffmpeg tests were quietly not run. ON by default
-# since E32: as an opt-in only the compose lane and CI set, a hand-run `pytest` skipped ~60 DB tests
+# since E32: as an opt-in only the compose lane set, a hand-run `pytest` skipped ~60 DB tests
 # and still passed. `SIFTLODE_TEST_REQUIRE_DB=0` is the explicit "pure-logic only" run.
 _REQUIRE_FULL = os.getenv("SIFTLODE_TEST_REQUIRE_DB", "1") != "0"
 

backend/tests/test_python_engine_contract.py

@@ -9,7 +9,7 @@ independent literal, there was no `.python-version`, no `requires-python`, and r
 
 **The contract is a chain, and it is split across two test files because no single runner can see
 every link.** This suite runs inside the test image, which mounts `backend/` and nothing else, so it
-cannot read the repo-root Dockerfile or the workflow. It therefore holds the link it CAN see, and the
+cannot read the repo-root Dockerfile. It therefore holds the link it CAN see, and the
 one that matters most here:
 
     the interpreter actually running  ==  backend/pyrightconfig.json  ==  backend/ruff.toml
@@ -17,7 +17,7 @@ one that matters most here:
 and `frontend/src/lib/pythonEngine.contract.test.ts` — which runs on the host, with the whole tree —
 holds the rest of the chain:
 
-    /.python-version  ==  pyrightconfig.json  ==  ruff.toml  ==  Dockerfile  ==  Dockerfile.test  ==  check.yml
+    /.python-version  ==  pyrightconfig.json  ==  ruff.toml  ==  Dockerfile  ==  Dockerfile.test
 
 Together they close the loop. To move the version: edit `/.python-version`, then follow the failures
 in both files. Every place they name is a place that would otherwise have been forgotten.