fix(release.yml): match ci.yml's pip-audit CVE-ignore for pytest 9.0.2

`ci.yml:287` runs `pip-audit --skip-editable --ignore-vuln CVE-2025-71176`
with a comment block explaining the carve-out. `release.yml:103` was
running `pip-audit --skip-editable` only — so every release attempt
failed the security gate on the identical known advisory that CI has
already decided to accept.

On the 2.7.0 release, this was the failure: `release.yml`'s
`security-audit` step reported

    Found 1 known vulnerability in 1 package
    Name   Version ID             Fix Versions
    ------ ------- -------------- ------------
    pytest 9.0.2   CVE-2025-71176 9.0.3

after the `v2.7.0` tag had already been pushed and the release PR
(#3276) had already merged to main.

Fix: copy the exact `--ignore-vuln CVE-2025-71176` flag and the full
rationale comment from `ci.yml:276–287` into `release.yml:102–115`.
The comment documents: CVE is a /tmp/pytest-of-{user} TOCTOU on UNIX;
fix is pytest 9.0.3, transitively blocked by syrupy 4.8.0 (hard-pinned
by pytest-textual-snapshot 1.1.0); attack boundary is local CI/dev
only (pytest is a dev dep, never installed on end-user systems);
single-tenant self-hosted runner means practical exploitability is
~0; exit plan is upstream PR
Textualize/pytest-textual-snapshot#24. When
that merges and a new pytest-textual-snapshot release ships, both
ci.yml and release.yml drop the ignore together.

Rerun path after merge: workflow-dispatch `release.yml` on `main`
with input `version=2.7.0`. The `v2.7.0` tag already points at
main's current HEAD (the release PR merge commit `a0f3ac12e`), so
a rerun publishes the same release artifacts that the tag-push
trigger would have published if the audit had passed the first time.

Signed-off-by: jgstern-agent <josh-agent@iterabloom.com>

Author: jgstern-agent

.ci/affected-tests.txt

@@ -1,9 +1,9 @@
 # Test selection manifest
-# Generated by smart-test at 2026-04-21T21:25:47-04:00
+# Generated by smart-test at 2026-04-21T22:29:13-04:00
 # Mode: targeted
 # Baseline: aa6d1c607b0f4ed471aff37c924a45ac8bcd4a77
 # Reason: version-only __init__.py changes
-# Changed files: 22
+# Changed files: 23
 # Changed source files: 6
 # Selected tests: 6
 #

.github/workflows/release.yml

@@ -100,7 +100,19 @@ jobs:
           pip install pip-audit bandit pip-licenses
 
       - name: Vulnerability scan (pip-audit)
-        run: pip-audit --skip-editable
+        run: |
+          # CVE-2025-71176: pytest /tmp/pytest-of-{user} TOCTOU on UNIX.
+          # Fix is pytest 9.0.3, but we are pinned below 9.0.0 transitively by
+          # syrupy 4.8.0 (hard-pinned by pytest-textual-snapshot 1.1.0).
+          # Impact assessment: local attack boundary only, reachable solely in
+          # CI/dev environments — pytest is a dev-only dep, never installed on
+          # end-user systems running hypergumbo. Our self-hosted runners are
+          # single-tenant, so practical exploitability is ~0.
+          # Exit plan: upstream PR to relax the syrupy pin is tracked at
+          # https://github.com/Textualize/pytest-textual-snapshot/pull/24
+          # When that merges and a new pytest-textual-snapshot release ships,
+          # bump pytest to 9.0.3+ and drop this ignore (same in ci.yml).
+          pip-audit --skip-editable --ignore-vuln CVE-2025-71176
 
       - name: Security linting (Bandit)
         run: |

CHANGELOG.md

@@ -10,6 +10,12 @@ This changelog tracks the **tool version** (package releases). The **schema vers
 
 ## [Unreleased]
 
+### Fixed
+
+#### CI / build system
+
+- **`release.yml` security-audit: `pip-audit` CVE-ignore brought in line with `ci.yml`**: the pre-publish vulnerability scan ran `pip-audit --skip-editable` without the `--ignore-vuln CVE-2025-71176` flag that `ci.yml` already uses, so every release attempt failed the security gate on the known pytest 9.0.2 TOCTOU advisory. Same rationale (dev-only transitive pin from `syrupy 4.8.0` via `pytest-textual-snapshot 1.1.0`, local attack boundary only, single-tenant self-hosted runner) and same exit plan (drop the ignore in both workflows when `Textualize/pytest-textual-snapshot#24` ships). Surfaced when the initial `v2.7.0` tag's `release.yml` run was rejected by the audit step after the release PR had already merged.
+
 ## [2.7.0] - 2026-04-21
 
 ### Added