fix(ci): audit the package's dependencies, not the tool venv

The device-types pilot failed pip-audit on pip 25.0.1 of the venv that also
held bandit and pip-audit. The package now goes into a venv of its own with
a current pip; its frozen set (URL installs left out) is what pip-audit
checks.

.gitea/workflows/driver.yml

@@ -137,18 +137,25 @@ jobs:
         with:
           python-version: "3.12"
       - name: Install
+        # Two venvs: the tools, and the package alone. Auditing the tools' venv
+        # reported the runner's own pip instead of anything the package brings.
         run: |
-          python -m venv .venv
-          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
-          .venv/bin/pip install -q "$STANDARD" bandit pip-audit
-          if [ -n "${{ inputs.pre-install }}" ]; then .venv/bin/pip install -q ${{ inputs.pre-install }}; fi
-          .venv/bin/pip install -q .
+          python -m venv .tools
+          .tools/bin/pip install -q --upgrade pip
+          .tools/bin/pip install -q "$STANDARD" bandit pip-audit
+          python -m venv .audit
+          .audit/bin/pip install -q --upgrade pip
+          if [ -n "${{ inputs.pre-install }}" ]; then .audit/bin/pip install -q ${{ inputs.pre-install }}; fi
+          .audit/bin/pip install -q .
       - name: bandit
-        run: bandit -q -r "$(napalm-standard package)"
+        run: .tools/bin/bandit -q -r "$(.tools/bin/napalm-standard package)"
       - name: pip-audit
-        # The installed set: what a user gets today from the package's ranges.
-        # A package not on PyPI yet (the driver itself, a git pre-install) is skipped with a note.
-        run: pip-audit --skip-editable --progress-spinner off
+        # What a user gets today from the package's ranges. Packages installed from
+        # a URL (the package itself, a git pre-install) are not on PyPI's index yet.
+        run: |
+          .audit/bin/pip freeze --all | grep -vE ' @ |^-e ' > audit-requirements.txt
+          cat audit-requirements.txt
+          .tools/bin/pip-audit -r audit-requirements.txt --no-deps --disable-pip --progress-spinner off
 
   build:
     runs-on: ubuntu-latest

CHANGELOG.md

@@ -12,6 +12,10 @@ The format follows [Keep a Changelog](https://keepachangelog.com/), versions fol
 - E501 is off under `tests/`: recorded device output keeps its lines (found in the
   device-types pilot).
 
+### Fixed
+- `security` audited the runner's own pip instead of the package: pip-audit now
+  checks a venv holding only the package and its dependencies.
+
 ## [0.1.0] - 2026-10-22
 
 ### Added