build(make): run every local suite from make test in a project virtualenv

make test installed the project into whatever PYTHON pointed at, which is
the system python3 by default. On Manjaro, Debian and Ubuntu that Python
is externally managed, so pip refuses (PEP 668) and not a single suite
runs, although AGENTS.md requires make test before every commit. It also
stopped at the first failing suite, so one broken linter hid the result
of every test behind it.

make test now creates .venv on first use and runs ci with --keep-going
and that interpreter, so every suite runs and make lists each failed
target. The path is fixed to the checkout: an exported VENV, which other
tooling sets, would otherwise redirect it. It is absolute because
run-e2e.sh changes into app/ before starting Flask. All other targets
keep PYTHON ?= python3.

Verified with a full make test: actionlint, ruff, yamllint, eslint,
hadolint, shellcheck, the lint, security, unit and integration suites,
bandit, pip-audit and 107 Cypress tests all pass.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitignore

@@ -5,6 +5,7 @@ app/static/cache/*
 .env
 app/cypress/screenshots/*
 .ruff_cache/
+.venv/
 app/node_modules/
 app/static/vendor/
 hadolint-results.sarif

Makefile

@@ -7,6 +7,8 @@ endif
 
 PYTHON ?= python3
 ACT ?= act
+TEST_VENV := $(CURDIR)/.venv
+TEST_PYTHON ?= $(TEST_VENV)/bin/python
 
 # Bootstrap the local .env from the checked-in env.example template.
 # Idempotent: leaves an existing .env untouched.
@@ -252,5 +254,8 @@ ci: lint security test-unit test-integration test-e2e
 	# Run the local CI suite.
 
 .PHONY: test
-test: ci
-	# Run the full validation suite.
+test:
+	# Run every local suite in a project virtualenv, since PEP 668 refuses pip on
+	# a system Python, and keep going so each failing suite reports.
+	@[ -x "$(TEST_PYTHON)" ] || python3 -m venv "$(TEST_VENV)"
+	$(MAKE) --keep-going ci PYTHON="$(TEST_PYTHON)"