ci: fix coverage target, pip-audit scope, bandit config

- --cov pointed at libs/svcforge_core/domain, a path that does not exist (the
  package nests one level deeper). Coverage measured 0.00% of the code. Use the
  module form, which is layout-independent.
- pip-audit --strict cannot audit our own editable, not-on-PyPI packages. Audit
  the locked dependency set instead and keep --strict.
- bandit re-reports B608/B104, which ruff's S ruleset already enforces with
  justified per-line noqa it cannot see. Skipped in config, with reasons.
- registry host was git.oci-oci; it is gitea.oci-oci.
- integration job set SVCFORGE_PG_DSN; conftest reads SVCFORGE_TEST_DSN.

pyproject.toml

@@ -72,6 +72,23 @@ known-first-party = ["svcforge_core", "services"]
 # input that reaches a helm release name.
 "tests/e2e/**" = ["S101", "S603", "S607"]
 
+[tool.bandit]
+# bandit is the belt to ruff's suspenders: ruff's `S` ruleset IS flake8-bandit and runs on
+# every file in the lint stage. These two skips are the rules ruff already enforces here,
+# where each real site carries an individually justified `# noqa` that bandit cannot see —
+# so bandit re-reports them as findings that ruff has already adjudicated.
+#
+#   B608 (SQL built by string) == ruff S608. Every occurrence interpolates `_COLUMNS`, a
+#        module constant. Tenant input goes through psycopg parameters, never the f-string,
+#        and ruff fails the build if that ever changes.
+#   B104 (bind 0.0.0.0)       == ruff S104. A container must bind all interfaces; the pod's
+#        network namespace is the boundary, not the listen address.
+#
+# Nothing else is skipped. If you add a third, justify it here or you are just turning the
+# gate off one rule at a time.
+skips = ["B608", "B104"]
+exclude_dirs = [".venv", "tests"]
+
 [tool.mypy]
 strict = true
 python_version = "3.12"