fix(ci): semgrep install fails on Gitea Act runner (no sudo/pipx)

Runner has no sudo binary but already runs as root, and no pipx. Call
apt-get directly and pip install --user semgrep instead.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/security.yml

@@ -62,10 +62,12 @@ jobs:
       - uses: actions/checkout@v4
       # The runner image lacks pip, and a semgrep job-container lacks the node that
       # actions/checkout needs — so install pip via apt on the standard image.
+      # Gitea's Act runner has no sudo binary but already runs as root, so call
+      # apt-get directly; pip install --user needs no pipx.
       - name: Install semgrep
         run: |
-          sudo apt-get update -qq && sudo apt-get install -y -qq python3-pip pipx
-          pipx install semgrep
+          apt-get update -qq && apt-get install -y -qq python3-pip
+          python3 -m pip install --user --break-system-packages semgrep || python3 -m pip install --user semgrep
       - name: Semgrep scan
         run: |
           export PATH="$HOME/.local/bin:$PATH"