ci: fix pip install under PEP 668 (externally-managed-environment)

The Debian runner image marks its Python as externally managed, so
`pip3 install` fails with error: externally-managed-environment, breaking
the test/lint/security workflows at the install step (unrelated to the code
under test). Add --break-system-packages; the runner is ephemeral so a
system-wide install is fine.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/lint.yml

@@ -17,7 +17,8 @@ jobs:
         run: |
           apt-get update -qq
           apt-get install -y -qq python3 python3-pip
-          pip3 install flake8
+          # Debian's Python is externally managed (PEP 668); the runner is ephemeral.
+          pip3 install --break-system-packages flake8
 
       - name: Run flake8
         run: flake8 . --exclude=__pycache__,.git

.gitea/workflows/security.yml

@@ -19,7 +19,8 @@ jobs:
         run: |
           apt-get update -qq
           apt-get install -y -qq python3 python3-pip
-          pip3 install bandit
+          # Debian's Python is externally managed (PEP 668); the runner is ephemeral.
+          pip3 install --break-system-packages bandit
 
       - name: Run bandit
         run: bandit -r . --exclude .git,__pycache__ -ll

.gitea/workflows/test.yml

@@ -17,7 +17,8 @@ jobs:
         run: |
           apt-get update -qq
           apt-get install -y -qq python3 python3-pip python3-pytest python3-psutil python3-requests
-          pip3 install pytest-cov
+          # Debian's Python is externally managed (PEP 668); the runner is ephemeral.
+          pip3 install --break-system-packages pytest-cov
 
       - name: Run pytest with coverage
         run: python3 -m pytest tests/ -v --cov=. --cov-report=term-missing --cov-config=.coveragerc