Complete RC6 supply chain gates

scripts/audit_python_dependencies.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+OUTPUT_DIR="${1:-artifacts}"
+if [ -n "${PYTHON_BIN:-}" ]; then
+  PYTHON_CMD="$PYTHON_BIN"
+else
+  PYTHON_CMD=""
+  for candidate in python3 python.exe python; do
+    if command -v "$candidate" >/dev/null 2>&1 &&
+      "$candidate" -c "import pip_audit" >/dev/null 2>&1; then
+      PYTHON_CMD="$candidate"
+      break
+    fi
+  done
+fi
+if [ -z "$PYTHON_CMD" ]; then
+  echo "No Python interpreter available for pip-audit." >&2
+  exit 1
+fi
+cd "$ROOT"
+mkdir -p "$OUTPUT_DIR"
+
+"$PYTHON_CMD" scripts/verify_security_exceptions.py
+mapfile -t ignored_ids < <(
+  "$PYTHON_CMD" scripts/verify_security_exceptions.py --print-ids | tr -d '\r'
+)
+
+common_args=(
+  -r backend/requirements-ci.lock
+  --no-deps
+  --disable-pip
+  --progress-spinner off
+  --format json
+)
+
+# Preserve the unfiltered evidence even when known time-boxed exceptions exist.
+"$PYTHON_CMD" -m pip_audit \
+  "${common_args[@]}" \
+  --output "$OUTPUT_DIR/pip-audit-full.json" || true
+
+policy_args=()
+for advisory_id in "${ignored_ids[@]}"; do
+  policy_args+=(--ignore-vuln "$advisory_id")
+done
+"$PYTHON_CMD" -m pip_audit \
+  "${common_args[@]}" \
+  "${policy_args[@]}" \
+  --output "$OUTPUT_DIR/pip-audit-policy.json"
+
+echo "Python dependency audit policy passed."