ci: use python3 -m ruff/pytest with isolated ruff

.gitea/workflows/ci.yml

@@ -49,7 +49,7 @@ jobs:
           pip install bandit pip-audit ruff --break-system-packages
 
       - name: Ruff lint
-        run: ruff check .
+        run: python3 -m ruff check . --isolated
 
       - name: Bandit (advisory)
         run: bandit -r . -q || true
@@ -61,7 +61,8 @@ jobs:
         run: |
           if [ -d tests ] || ls test_*.py *_test.py 2>/dev/null; then
             pip install pytest --break-system-packages
-            PYTHONPATH=. pytest -q
+            export PYTHONPATH=.
+            python3 -m pytest -q
           else
             echo "No tests found — skip"
           fi

scripts/ci-python.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Local / Gitea python-ci lane (ruff + pytest hard gates).
+set -euo pipefail
+
+export PYTHONPATH=.
+
+python3 -m ruff check . --isolated
+python3 -m pytest -q