Remove the merge-blocking pip-audit dependency gate

[KedoKudo]

The Dependency check step ran pip-audit --local -s osv as a plain step inside the Unit tests job, which made it merge-blocking. Because pip-audit queries the live OSV database, a newly published advisory could arm the gate with no change to the code — and the red X then landed on whichever contributor happened to open the next pull request. Clearing it meant adding another minimum-version floor to pyproject.toml; twelve had accumulated that way, spread across four dependency sections.

Dependency scanning is not going away, it just becomes report-only: the conda-build job still runs Grype and uploads SARIF to the Security tab. That matches the non-blocking posture already used across the other managed repositories, so the template no longer ships a merge-blocking dependency scan.

Changes

• .github/workflows/test_and_deploy.yaml — drop the Dependency check step.
• pyproject.toml — drop the audit-deps task and the pip-audit developer dependency.
• pixi.lock — regenerated; pip-audit and its transitive tree are gone (−243/+20, removals only, no dependency churn).
• README.md — the "Auditing dependencies" section now documents the report-only posture and shows how to add pip-audit back as a local, on-demand task for projects that want one.

The version floors are kept

All twelve stay, deliberately — removing them would quietly let a fresh environment resolve back onto known-vulnerable releases, which is a separate decision from removing the gate. They are now simply unenforced: nothing in CI checks or refreshes them, and a stale floor cannot fail a build. A comment above the main block says so.

Section	Floors
[tool.pixi.dependencies]	h2, brotli, urllib3, filelock, virtualenv, cryptography, requests, pillow, msgpack-python
[tool.pixi.pypi-dependencies]	jaraco-context
[tool.pixi.feature.test.dependencies]	pytest
[tool.pixi.feature.developer.dependencies]	pip

Note virtualenv = ">=20.36.1,<21" — the <21 cap is a hatch compatibility constraint, not a CVE floor. Do not strip it if the floors are ever cleaned up.

Verification

All run locally on this branch:

• pixi run test → 1 passed
• pixi run pre-commit run --all-files → 14 hooks pass (incl. check toml, check yaml, yamllint, taplo-format)
• pixi install --frozen --skip examplepyapp → succeeds, so the regenerated lock is consistent with the manifest (CI installs with --frozen)
• pixi run build-docs → build succeeded
• pixi task list → audit-deps absent; the README task listing was updated to match
• Parsed the workflow: the tests job no longer contains Dependency check, and Scan installed environment with Grype is still present in conda-build

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 2.29%. Comparing base (880ce13) to head (5f77cb8).

Additional details and impacted files

@@          Coverage Diff          @@
##            main    #193   +/-   ##
=====================================
  Coverage   2.29%   2.29%           
=====================================
  Files          4       4           
  Lines        131     131           
=====================================
  Hits           3       3           
  Misses       128     128           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.