Fix pip-audit CI failure by ignoring PYSEC alias for accepted pip advisory

[Copilot]

Summary

The pip-audit job failed because the accepted pip vulnerability was reported as PYSEC-2026-196 while CI only ignored CVE-2026-3219. This updates the workflow to ignore both IDs for the same accepted runner-provided pip issue.

Related issue

Issue linking is handled automatically.

Changes

• Workflow advisory-ID alignment
  • Updated .github/workflows/ci.yml in pip-audit step to ignore both identifiers for the same vulnerability:
    • CVE-2026-3219
    • PYSEC-2026-196
• Inline policy note update
  • Clarified comment text to document the CVE/PYSEC dual-ID mapping.

pip-audit --strict \
  --ignore-vuln=CVE-2026-3219 \
  --ignore-vuln=PYSEC-2026-196

Testing

• Tests pass (pytest tests/ -v)
• Linting passes (ruff check src/zettelforge/)
• New tests added for new functionality
• No new external infrastructure dependencies without discussion