fix: add lint rule to detect bare pip install and fix beval.yml violation - #2548

Description

Adds CI enforcement for the repo's uv-first Python convention by introducing a reusable lint workflow that detects bare pip install calls in workflows, scripts, and Python files. Fixes the one known existing violation in beval.yml and updates experimental skill error strings to recommend uv pip install.

Companion to #1313, which adds the corresponding prohibitions to the Python instruction files. Without this enforcement backstop, those rules have no CI validation and regressions can silently appear.

Related Issue(s)

Fixes #2500
Companion to #1313

Type of Change

Select all that apply:

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update

Infrastructure & Configuration:

• GitHub Actions workflow
• Linting configuration (markdown, PowerShell, etc.)
• Security configuration
• DevContainer configuration
• Dependency update

AI Artifacts:

• Reviewed contribution with hve-builder and addressed all actionable findings
• Copilot instructions (.github/instructions/*.instructions.md)
• Copilot prompt (.github/prompts/*.prompt.md)
• Copilot agent (.github/agents/*.agent.md)
• Copilot skill (.github/skills/*/SKILL.md)
• Copilot hook (.github/hooks/*/*.json)
• Eval spec added/updated for changed AI artifacts (evals/)

Other:

• Script/automation (.ps1, .sh, .py)
• Other (please describe):

Testing

All 4 local test scenarios passed successfully:

1. Clean state: python scripts/lint_pip_install.py → Success: No bare 'pip install' calls found.
2. Violation detection: Injected run: pip install malicious-package into a fake workflow → correctly flagged and exited 1.
3. Exclusion logic: Injected pip install mock-package into evals/fake_eval_test.py → correctly ignored per acceptance criteria.
4. UV allowance: Injected run: uv pip install fastapi into a fake workflow → correctly passed.

Additionally verified that .venv directories, YAML name: metadata lines, and THIRD-PARTY-NOTICES are properly excluded to prevent false positives.

Checklist

Required Checks

• Documentation is updated (if applicable)
• Files follow existing naming conventions
• Changes are backwards compatible (if applicable)
• Tests added for new functionality (if applicable)

AI Artifact Contributions

• Used hve-builder review mode to review contribution
• Addressed all actionable findings from the hve-builder review
• Verified contribution follows common standards and type-specific requirements

Required Local Checks

• Local validation aggregate: npm run validate:local (N/A — no docs/PS/md changed)
• Documentation validation (if docs changed): npm run validate:docs (N/A)
• Spell checking: npm run spell-check (N/A — no prose changed)
• Link validation: npm run lint:md-links (N/A — no URLs added)

Security Considerations

• This PR does not contain any sensitive or NDA information
• Any new dependencies have been reviewed for security issues
• Security-related scripts follow the principle of least privilege

All GitHub Actions in new and modified workflows are SHA-pinned per repo convention:

• actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
• astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9

The beval.yml install remains pinned to commit SHA d9f46c24f03b0b806d928a8a8ce2fc66d8e470fb to mitigate supply-chain risk.

Additional Notes

Files changed (7 total):