Preserve pre-existing WIP from master's working tree. When a project
has a uv.lock alongside pyproject.toml, run pip-audit and pytest under
`uv run --directory $project` so they execute in the project's own
managed venv instead of whatever pytest/pip-audit happens to be on PATH.
Lifted verbatim from master's uncommitted working tree; committed on
this branch as the base for subsequent Bug B (tests.sh SIGPIPE) and
Bug C (pip-audit venv) fixes which both modify these regions.
The `-not -path "*/.*"` filter on the `find` probes in lint.sh and sast.sh
was intended to exclude .venv / .git / __pycache__ but also excludes any
target path that lives UNDER a hidden ancestor directory.
Concrete trigger: running the gauntlet on a Claude Code worktree at
.../.claude/worktrees/<name>/. Every file in the tree matches `*/.*` via
the .claude/ component, so the probes return empty, the scripts skip
with "No Python or Go files found", and run-all.sh records the check as
passed by virtue of the 0 exit. The check never actually ran.
Switch to explicit prunes for the well-known noise dirs. As a free
bonus, replace `| head -1` with `-print -quit` so the probe also stops
being susceptible to SIGPIPE under `set -o pipefail` (relevant on dense
trees with many matches).
Verified: probe now returns first .py file in both .claude/-rooted and
normal project paths.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
