fix(ci): Use virtual environments instead of --system flag

The --system flag fails on GitHub Actions runners because Python is
externally managed. Using uv venv + uv pip install instead.

.github/workflows/ci.yml

@@ -25,14 +25,16 @@ jobs:
       - name: Set up Python
         run: uv python install 3.11
 
-      - name: Install Ruff
-        run: uv pip install --system ruff
+      - name: Create venv and install Ruff
+        run: |
+          uv venv
+          uv pip install ruff
 
       - name: Ruff Format Check
-        run: ruff format --check scripts/
+        run: uv run ruff format --check scripts/
 
       - name: Ruff Lint Check
-        run: ruff check scripts/
+        run: uv run ruff check scripts/
 
   security:
     name: Security Scan
@@ -47,11 +49,13 @@ jobs:
       - name: Set up Python
         run: uv python install 3.11
 
-      - name: Install Bandit
-        run: uv pip install --system "bandit[toml]"
+      - name: Create venv and install Bandit
+        run: |
+          uv venv
+          uv pip install "bandit[toml]"
 
       - name: Run Bandit Security Scan
-        run: bandit -c pyproject.toml -r scripts/ --exclude scripts/tests/
+        run: uv run bandit -c pyproject.toml -r scripts/ --exclude scripts/tests/
 
   test:
     name: Tests
@@ -66,13 +70,14 @@ jobs:
       - name: Set up Python
         run: uv python install 3.11
 
-      - name: Install dependencies
+      - name: Create venv and install dependencies
         run: |
-          uv pip install --system -r requirements.txt
-          uv pip install --system pytest pytest-asyncio
+          uv venv
+          uv pip install -r requirements.txt
+          uv pip install pytest pytest-asyncio
 
       - name: Run Tests
-        run: pytest scripts/tests/ -v --tb=short
+        run: uv run pytest scripts/tests/ -v --tb=short
 
   build:
     name: Build EPUB