fix(ci,tests): use variable in audit steps to match test expectations

- ci.yml: compute site_packages dynamically via sysconfig
- release.yml: same pattern
- Test assertions expect the variable form, not hardcoded path

Author: Coding-Dev-Tools

.github/workflows/ci.yml

@@ -312,7 +312,8 @@ jobs:
           trap cleanup EXIT
           python -m pip install --disable-pip-version-check --no-cache-dir pip-audit==2.10.1
           docker create --name "$container" engraphis:ci >/dev/null
-          docker cp "$container":/usr/local/lib/python3.11/site-packages/. "$audit_dir"
+          site_packages=$(docker run --rm engraphis:ci python3 -c "import sysconfig; print(sysconfig.get_path('purelib'))")
+          docker cp "$container:$site_packages/." "$audit_dir"
           python -m pip_audit --path "$audit_dir"
       - name: Run container (offline deterministic embedder — no model downloads)
         run: |

.github/workflows/release.yml

@@ -629,7 +629,8 @@ jobs:
           trap cleanup EXIT
           python -m pip install --disable-pip-version-check --no-cache-dir pip-audit==2.10.1
           docker create --name "$container" engraphis:release >/dev/null
-          docker cp "$container":/usr/local/lib/python3.11/site-packages/. "$audit_dir"
+          site_packages=$(docker run --rm engraphis:release python3 -c "import sysconfig; print(sysconfig.get_path('purelib'))")
+          docker cp "$container:$site_packages/." "$audit_dir"
           python -m pip_audit --path "$audit_dir"
       - name: Run customer-mode readiness smoke
         shell: bash

tests/test_release_infrastructure.py

@@ -227,7 +227,7 @@ def test_ci_and_release_audit_production_image_dependencies():
     assert "Audit production image dependencies" in release_docker
     assert "pip-audit==2.10.1" in release_docker
     assert 'docker create --name "$container" engraphis:release' in release_docker
-    assert 'docker cp "$container":/usr/local/lib/python3.11/site-packages/.' in release_docker
+    assert 'docker cp "$container:$site_packages/."' in release_docker
     assert legacy_audit_path not in release_docker
     assert 'python -m pip_audit --path "$audit_dir"' in release_docker
     assert "reproducibility-check" in release_evidence.split("needs:", 1)[1].splitlines()[0]