fix(ci): 安全/风格检查 pip install 加固——防缓存损坏导致 CI 失败

问题：Gitea Actions cache 返回损坏归档时（cache EOF/deserialization failed），
pip install pip-audit/detect-secrets/vulture 因 hash mismatch 直接 exit 1，
导致 validate-security/validate-style 整体失败。

修复：
- detect-secrets/pip-audit/vulture 安装加 --no-cache-dir
- pip-audit 安装失败后 graceful skip（本身是 advisory-only）
- detect-secrets 安装失败后重试一次 --no-binary
- vulture 安装失败后 skip 死代码检测（本身是 advisory-only）

scripts/ci/validate_security.sh

@@ -8,7 +8,13 @@ echo "=== CI Validate: 安全扫描 ==="
 # --- 密钥检测 ---
 echo ""
 echo "=== [1/4] Secret detection (detect-secrets) ==="
-python3 -m pip install -q detect-secrets
+python3 -m pip install -q --no-cache-dir detect-secrets || {
+  echo "⚠️  detect-secrets install failed, retrying without cache..."
+  python3 -m pip install -q --no-cache-dir --no-binary :all: detect-secrets || {
+    echo "❌ detect-secrets install failed after retry"
+    exit 1
+  }
+}
 detect-secrets --version
 
 detect-secrets scan \
@@ -72,17 +78,27 @@ fi
 # --- Pip-audit 依赖漏洞扫描（仅告警）---
 echo ""
 echo "=== [3/4] Python dependency vulnerability scan (pip-audit, advisory only) ==="
-python3 -m pip install -q pip-audit
-pip-audit --version
-EXIT_CODE=0
-for req_file in requirements.txt requirements-base.txt requirements-dev.txt; do
-  if [ -f "$req_file" ]; then
-    echo "--- Scanning $req_file ---"
-    pip-audit -r "$req_file" --desc on 2>&1 | head -40 || EXIT_CODE=$?
-    echo ""
-  fi
-done
-echo "pip-audit scan completed (advisory mode - warnings only, not blocking CI)"
+python3 -m pip install -q --no-cache-dir pip-audit || {
+  echo "⚠️  pip-audit install failed (cache issue?), retrying..."
+  python3 -m pip install -q --no-cache-dir pip-audit || {
+    echo "⚠️  pip-audit unavailable, skipping dependency vulnerability scan (advisory)"
+    pip-audit --version 2>/dev/null || true
+  }
+}
+if command -v pip-audit >/dev/null 2>&1 || python3 -m pip show pip-audit >/dev/null 2>&1; then
+  pip-audit --version
+  EXIT_CODE=0
+  for req_file in requirements.txt requirements-base.txt requirements-dev.txt; do
+    if [ -f "$req_file" ]; then
+      echo "--- Scanning $req_file ---"
+      pip-audit -r "$req_file" --desc on 2>&1 | head -40 || EXIT_CODE=$?
+      echo ""
+    fi
+  done
+  echo "pip-audit scan completed (advisory mode - warnings only, not blocking CI)"
+else
+  echo "⚠️  pip-audit not available, skipping dependency vulnerability scan (advisory)"
+fi
 
 # --- CI脚本语法校验 ---
 echo ""

scripts/ci/validate_style.sh

@@ -24,7 +24,7 @@ echo "✅ Code formatting checks passed"
 echo ""
 echo "=== [3/3] Dead code detection (vulture, advisory only) ==="
 set +e
-python3 -m pip install -q vulture
+python3 -m pip install -q --no-cache-dir vulture || echo "⚠️  vulture install failed, skipping dead code detection"
 vulture --version
 echo "告警模式，不阻断CI。置信度>=90%建议尽快确认。"
 echo ""