fix(ci): audit the package's dependencies, not the tool venv

The device-types pilot failed pip-audit on pip 25.0.1 of the venv that also
held bandit and pip-audit. The package now goes into a venv of its own with
a current pip; its frozen set (URL installs left out) is what pip-audit
checks.

CHANGELOG.md

@@ -12,6 +12,10 @@ The format follows [Keep a Changelog](https://keepachangelog.com/), versions fol
 - E501 is off under `tests/`: recorded device output keeps its lines (found in the
   device-types pilot).
 
+### Fixed
+- `security` audited the runner's own pip instead of the package: pip-audit now
+  checks a venv holding only the package and its dependencies.
+
 ## [0.1.0] - 2026-10-22
 
 ### Added