ci: use pip-audit --local to avoid internal venv ensurepip failure

The standalone Python 3.10 binary's venv ensurepip step exits 127.
Workaround: install requirements + pip-audit into the same env,
then audit with --local (no internal venv creation).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/lint.yml

@@ -60,10 +60,13 @@ jobs:
           # Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary
           curl -sSL "https://github.com/indygreg/python-build-standalone/releases/download/20241002/cpython-3.10.15+20241002-x86_64-unknown-linux-gnu-install_only.tar.gz" \
             | tar -xz -C /opt
-          /opt/python/bin/pip install pip-audit
+          # Install pip-audit + the bot's requirements into the same env.
+          # Using --local avoids pip-audit creating an internal venv (which fails
+          # with ensurepip exit 127 on this standalone build).
+          /opt/python/bin/pip install pip-audit -r matrixbot/requirements.txt
 
       - name: Audit matrixbot dependencies
-        run: /opt/python/bin/pip-audit -r matrixbot/requirements.txt
+        run: /opt/python/bin/pip-audit --local
 
   secret-scan:
     name: Secret scan (gitleaks)