chore: add bandit + pip-audit to CI (Phase 1.1 close-out) 769e44c unverified Claude commited on May 24