Bug: CI used 'pip audit ... || true' which:
1. Relied on pip-audit being pre-installed (not guaranteed)
2. Suppressed all errors with '|| true', hiding security issues
Fix:
- Install pip-audit explicitly in CI workflow
- Remove '|| true' to fail on security vulnerabilities
- Use requirements-lock.txt instead of requirements.txt for reproducibility
- Check both production and dev dependencies
This ensures:
- Security audit actually runs and fails on vulnerabilities
- Locked dependencies are used for consistent results
- No silent failures masking security issues
ik
ed78a17109