ci(lint): bootstrap venv via py.exe launcher; bump coverage to 80%

act_runner runs as SYSTEM and does not have plain 'python' in PATH; use py.exe launcher (-3.11) to bootstrap the venv when missing. The production venv at F:\CI\python\venv normally already exists, so the bootstrap is just a fallback. Also align coverage threshold to 80% (raised in A5, see AGENTS.md).

.gitea/workflows/lint.yml

@@ -80,19 +80,20 @@ jobs:
         run: |
           $ErrorActionPreference = 'Stop'
 
-          # python is provided by the host (machine-wide install in PATH).
+          # Production venv lives at F:\CI\python\venv (per AGENTS.md).
-          # Requires Python >=3.11 per pyproject.toml.
+          # If missing, bootstrap it via the Windows Python launcher (py -3.11),
-          $py = (Get-Command python -ErrorAction Stop).Source
+          # since the act_runner SYSTEM service does NOT have plain "python" in PATH.
-          Write-Host "Using python: $py"
+          $venvPy = Join-Path $env:VENV_DIR 'Scripts\python.exe'
-          & $py --version
+          if (-not (Test-Path $venvPy)) {
-          if ($LASTEXITCODE -ne 0) { throw "python --version failed" }
+            Write-Host "Venv missing, bootstrapping at $env:VENV_DIR"
-
+            $launcher = (Get-Command py.exe -ErrorAction Stop).Source
-          if (-not (Test-Path "$env:VENV_DIR\Scripts\python.exe")) {
+            & $launcher -3.11 -m venv $env:VENV_DIR
-            Write-Host "Creating venv at $env:VENV_DIR"
-            & $py -m venv $env:VENV_DIR
             if ($LASTEXITCODE -ne 0) { throw "venv creation failed" }
           }
-          $venvPy = Join-Path $env:VENV_DIR 'Scripts\python.exe'
+          Write-Host "Using venv python: $venvPy"
+          & $venvPy --version
+          if ($LASTEXITCODE -ne 0) { throw "python --version failed" }
+
           & $venvPy -m pip install --upgrade pip
           if ($LASTEXITCODE -ne 0) { throw "pip upgrade failed" }
           & $venvPy -m pip install -e ".[dev]"
@@ -112,9 +113,9 @@ jobs:
           & $venvPy -m mypy --strict src
           if ($LASTEXITCODE -ne 0) { throw "mypy failed" }
 
-      - name: pytest (coverage >= 70%)
+      - name: pytest (coverage >= 80%)
         shell: powershell
         run: |
           $venvPy = Join-Path $env:VENV_DIR 'Scripts\python.exe'
-          & $venvPy -m pytest tests/python --cov=ci_orchestrator --cov-fail-under=70
+          & $venvPy -m pytest tests/python --cov=ci_orchestrator --cov-fail-under=80
           if ($LASTEXITCODE -ne 0) { throw "pytest failed" }