Fix CI: install flake8/bandit with --break-system-packages; make scripts lint-clean

The previous attempt used a sed pattern with the wrong indentation and changed nothing. Both
workflows now pass the flag (verified in the diff). render_terminal.py is reformatted to satisfy flake8.

.gitea/workflows/lint.yml

@@ -17,7 +17,8 @@ jobs:
         run: |
           apt-get update -qq
           apt-get install -y -qq python3 python3-pip
-          pip3 install flake8
+          # Debian's Python is externally managed (PEP 668); the runner is ephemeral.
+          pip3 install --break-system-packages flake8
 
       - name: Run flake8
         run: flake8 . --exclude=__pycache__,.git

.gitea/workflows/security.yml

@@ -19,7 +19,8 @@ jobs:
         run: |
           apt-get update -qq
           apt-get install -y -qq python3 python3-pip
-          pip3 install bandit
+          # Debian's Python is externally managed (PEP 668); the runner is ephemeral.
+          pip3 install --break-system-packages bandit
 
       - name: Run bandit
         run: bandit -r . --exclude .git,__pycache__ -ll