fix(ci): lint must use an ephemeral venv, not the production one

The python lint job set VENV_DIR=F:\CI\python\venv (the shared
orchestrator venv) and ran `pip install -e ".[dev]"`. Every lint run
repointed ci_orchestrator at the lint job's transient checkout; once
act_runner cleaned that dir, all later smoke/build jobs failed with
"No module named ci_orchestrator". Use a job-local venv under
github.workspace, rebuilt fresh each run.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/lint.yml

@@ -69,7 +69,12 @@ jobs:
 
     env:
       PYTHONIOENCODING: utf-8
-      VENV_DIR: F:\CI\python\venv
+      # Job-local, ephemeral venv. MUST NOT be the production venv
+      # (F:\CI\python\venv): an editable install here would repoint the
+      # shared orchestrator package at this run's transient checkout and
+      # break every later smoke/build job with "No module named
+      # ci_orchestrator". github.workspace is discarded after the job.
+      VENV_DIR: ${{ github.workspace }}\.venv-lint
 
     steps:
       - name: Checkout
@@ -94,30 +99,14 @@ jobs:
 
           $venvPy = Join-Path $env:VENV_DIR 'Scripts\python.exe'
 
-          # Probe: a broken venv (pyvenv.cfg pointing to a deleted base interpreter)
-          # writes "No Python at ..." to stderr; under $ErrorActionPreference='Stop'
-          # native stderr becomes a terminating exception (AGENTS.md error #12),
-          # so probe with SilentlyContinue + try/catch.
-          $venvOk = $false
-          if (Test-Path $venvPy) {
-            try {
-              $prevEAP = $ErrorActionPreference
-              $ErrorActionPreference = 'SilentlyContinue'
-              & $venvPy --version 2>&1 | Out-Null
-              if ($LASTEXITCODE -eq 0) { $venvOk = $true }
-            }
-            catch { $venvOk = $false }
-            finally { $ErrorActionPreference = $prevEAP }
-          }
-
-          if (-not $venvOk) {
-            Write-Host "Venv missing or broken, (re)bootstrapping at $env:VENV_DIR with $env:CI_PYTHON_LAUNCHER"
-            if (Test-Path $env:VENV_DIR) {
-              Remove-Item $env:VENV_DIR -Recurse -Force
-            }
-            & $env:CI_PYTHON_LAUNCHER -m venv $env:VENV_DIR
-            if ($LASTEXITCODE -ne 0) { throw "venv creation failed" }
+          # Always build a fresh, job-local venv. Never reuse or repair a
+          # shared one — lint must be fully isolated from the production
+          # orchestrator venv.
+          if (Test-Path $env:VENV_DIR) {
+            Remove-Item $env:VENV_DIR -Recurse -Force
           }
+          & $env:CI_PYTHON_LAUNCHER -m venv $env:VENV_DIR
+          if ($LASTEXITCODE -ne 0) { throw "venv creation failed" }
 
           Write-Host "Using venv python: $venvPy"
           & $venvPy --version