fix(ci): isolate parser dependencies without venv

.gitea/workflows/ci-deploy.yml

@@ -55,16 +55,6 @@ jobs:
         with:
           node-version: '20'
 
-      # The Debian runner's system Python omits ensurepip/python3-venv. Use the
-      # self-contained Actions runtime so the parser test can create an isolated
-      # environment without mutating the runner or requiring sudo.
-      - name: Setup Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-          cache: pip
-          cache-dependency-path: tools/summarizer/requirements-linux.lock
-
       - name: Test repository safety scripts
         # Standard-library only and plan-only: this validates the synthetic benchmark harness
         # without contacting Ollama, pulling a model, or requiring package installation.
@@ -80,14 +70,15 @@ jobs:
       - name: Test document parser boundary
         working-directory: tools/summarizer
         run: |
-          python3 -m venv .venv-ci
-          . .venv-ci/bin/activate
-          python -m pip install --upgrade pip
-          python -m pip install --require-hashes \
+          # The Debian runner has pip but intentionally omits python3-venv.
+          # Install into the checkout so CI remains isolated without sudo or a
+          # mutable runner-global Python environment.
+          rm -rf .python-ci
+          python3 -m pip install --target .python-ci --require-hashes \
             --extra-index-url https://download.pytorch.org/whl/cpu \
             -r requirements-linux.lock
-          python -m pip install pytest==8.3.5 httpx2==2.12.0
-          AI_SERVICE_SKIP_MODEL_LOAD=1 python -m pytest -q
+          python3 -m pip install --target .python-ci pytest==8.3.5 httpx2==2.12.0
+          PYTHONPATH="$PWD/.python-ci" AI_SERVICE_SKIP_MODEL_LOAD=1 python3 -m pytest -q
 
       - name: Restore backend
         # The runner/proxy has occasionally supplied checksum-invalid NuGet cache entries (NU3008).