pip-audit

uv audit tested: fast but narrower gate than pip-audit

Astral's uv package manager gained uv audit and UV_MALWARE_CHECK. Hands-on testing against pip-audit reveals what these experimental security gates actually catch.