When a project has pyproject.toml but no uv.lock, audit isn't
possible without mutating the project (running 'uv lock' or
'uv sync'). The bare 'pip-audit' fallback was incorrect — it
audited pip-audit's own bundled venv, producing false positives
for pip/urllib3. Skip with a clear message pointing to 'uv sync'
instead, so the gauntlet stays read-only.
Exit code 2 mirrors the existing convention used when a check
tool isn't installed (e.g., pip-audit not installed at line 27);
run-all.sh recognizes it as "skipped" rather than passed or failed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
9761525e9f